It depends on the link type. An open "anyone with the link" address works for whoever receives it and cannot be tracked by person. A link limited to named people or a sign in requirement stops at the intended recipient, so a forward fails. Choose the type to match how sensitive the document is.
Link types and what a forward does
Microsoft's SharePoint documentation describes the options clearly, and the pattern holds in most sharing tools:
| Link type | What happens on forward |
|---|---|
| Only people in your organisation | Works for anyone inside the organisation |
| Anyone with the link | Works internally or externally, and you cannot track who has access or who has accessed the item |
| Specific people | Works only for the people you named, who must verify their identity |
The documentation also notes that administrators can restrict Anyone links so they must expire within a set number of days or give View permission only.
Think of the link type as a choice about how far a mistake can travel.
Why customers forward
Forwarding is rarely malicious. A procurement lead passes your pack to security. Security passes it to an architect. An architect passes it to a consultant. Each step is reasonable from their side, and each one expands the audience without your knowledge.
You cannot stop reasonable behaviour, but you can design for it.
Design for forwarding
- Use specific people links for sensitive files. Ask for every reviewer's address up front. Adding a person takes a minute.
- State the rule in the cover note. For example: "This link is for the named reviewers. If others need access, reply with their addresses and we will add them." People generally comply when the path is easy.
- Expire the link. Even if it is forwarded, it stops working. See how long a share link should last.
- Keep sensitive content out of low control links. If a document is fine for open circulation, an Anyone link is acceptable. If not, do not use one.
- Check access logs. A named link tied to an unexpected identity is a signal. See log who opened your shared security evidence.
What if you find it was forwarded
Do not accuse. Ask the customer who else needs access, then add those people formally and, if needed, replace the original link. If the forward reached someone clearly outside the agreed circle, treat it as an incident and follow your process. See what if you send one customer's evidence to another for the containment steps.
A note on contract terms
Your agreement may already say who within the customer, and who outside, may see confidential material. Technical controls enforce your intent, but the contract states it. Ask legal to make sure the two agree, and use their wording in your cover note.
Make the easy path the right one
If it is hard to add a reviewer, people forward. If adding is fast, they ask you. Give customers a named contact for access requests and answer within a day. That alone prevents most unplanned forwarding.
Safeguard's SBOM exports and compliance evidence are files you place in the sharing tool of your choice, where you set the link type and expiry. A free scan shows an example export.
Quick check
Can you stop a customer forwarding a named link?
They can forward the message, but the link will not open for anyone you did not name, unless your tool allows guests to share further. Check that setting.
Are open links ever acceptable?
For public or low sensitivity material, yes. For SBOMs with detail, reports or findings, prefer named access.
Sources
Last reviewed: 19 October 2026.
