SECURE YOUR GOOGLE DRIVE

Protect the files you cannot afford to lose.

Google Drive can hold your documents, photographs, identity records, financial information, work files and backups. Securing Drive means securing the Google Account behind it, controlling who can access your files and protecting the devices where those files are stored.

Your Google Account is the key to your Drive.

Google says Drive encrypts files in transit and at rest. But encryption does not stop an account owner from accidentally sharing a sensitive document with the wrong person.

What is Google Drive?
Google Drive is Google's cloud storage service. You can store files and folders online and access them from supported devices.
What does Restricted mean?
Restricted sharing means only people who have been given access can open the file or folder.
What does Anyone with the link mean?
It means the file or folder can be accessed by anyone who has the link, subject to the sharing permissions you configure.
What is 2-Step Verification?
It adds another authentication step after your password, making it harder for someone who only knows your password to access your Google Account.
What happens when I make a file available offline?
Google says offline Drive files are stored on your device. That means the security of the device becomes part of the security of the file.
Does encryption make sharing safe?
No. Encryption protects the data while it is transmitted and stored, but you can still intentionally or accidentally give another person access to a file.
GOOGLE DRIVE SECURITY

Secure the account, the files, the sharing and the devices.

Work through these checks one at a time. Start with your Google Account, then move into Drive permissions and the devices that access your files.

Secure the Google Account behind Drive

Google Drive is protected by your Google Account, so the first step is securing the account that controls access to your files.

Click to see protection steps

Step-by-step

  1. Sign in to your Google Account.
  2. Open Security.
  3. Review your account security recommendations.
  4. Make sure your Google Account password is strong and unique.
  5. Remove security methods or devices you no longer control.

VERIFY: Confirm that your Google Account itself is secure before protecting individual Drive files.

Turn on 2-Step Verification

2-Step Verification adds another layer of protection when someone tries to sign in with your password.

Click to see protection steps

Step-by-step

  1. Open your Google Account.
  2. Select Security.
  3. Find 2-Step Verification.
  4. Follow Google's setup instructions.
  5. Choose an authentication method appropriate for your devices.
  6. Complete the setup and test the sign-in process.

VERIFY: Do not assume 2-Step Verification is working until you have successfully tested it.

Use a passkey when appropriate

Passkeys can provide strong protection against many phishing attacks and can be used instead of traditional passwords in supported sign-in flows.

Click to see protection steps

Step-by-step

  1. Open your Google Account security settings.
  2. Locate the section for Passkeys.
  3. Create a passkey on a device you personally control.
  4. Protect the device with a secure PIN, password or biometric method.
  5. Keep another recovery method available.

VERIFY: Only create passkeys on devices you trust and personally control.

Run Google's Security Checkup

Security Checkup helps you review important Google Account security settings and identify areas that need attention.

Click to see protection steps

Step-by-step

  1. Open your Google Account.
  2. Go to the Security section.
  3. Open Security Checkup.
  4. Review recent security activity.
  5. Review your sign-in methods and recovery information.
  6. Resolve warnings you do not recognize.

VERIFY: Do not dismiss a security warning simply because you are unsure what it means.

Review devices signed in to Google

An old phone, lost laptop or forgotten browser session can continue to represent a security risk.

Click to see protection steps

Step-by-step

  1. Open your Google Account's Security page.
  2. Find Your devices.
  3. Review every listed phone, tablet and computer.
  4. Select a device you no longer own or recognize.
  5. Sign it out where appropriate.
  6. Investigate unfamiliar devices instead of ignoring them.

VERIFY: Every device with access to your Drive should be a device you recognize and control.

Review recent security activity

Unexpected sign-ins, password changes or recovery changes can indicate that someone has gained access to your Google Account.

Click to see protection steps

Step-by-step

  1. Open Google Account → Security.
  2. Review Recent security activity.
  3. Look for unfamiliar sign-ins or security changes.
  4. If something is not yours, secure the account immediately.
  5. Change your password and review 2-Step Verification if necessary.

VERIFY: Do not approve or ignore an activity notification you did not initiate.

Check Drive sharing permissions

A file can be perfectly secure inside your account and still be exposed because it was shared with the wrong person.

Click to see protection steps

Step-by-step

  1. Open Google Drive.
  2. Select a sensitive file or folder.
  3. Click Share.
  4. Review everyone listed under people and groups with access.
  5. Remove people who no longer need access.
  6. Confirm each person's role is appropriate.

VERIFY: Every person with access should have a legitimate reason to have it.

Prefer Restricted sharing

Restricted access is safer for sensitive documents because only people who have been explicitly granted access can open them.

Click to see protection steps

Step-by-step

  1. Select the file or folder.
  2. Click Share.
  3. Find General access.
  4. Choose Restricted.
  5. Add only the specific people who need access.

VERIFY: Confirm that sensitive documents are not accidentally available to anyone with a link.

Be careful with 'Anyone with the link'

Anyone who has a link may be able to access a file when link sharing is enabled, depending on the permission settings.

Click to see protection steps

Step-by-step

  1. Open the file's Share settings.
  2. Check General access.
  3. If you see Anyone with the link, decide whether that access is genuinely necessary.
  4. Change sensitive files back to Restricted when broad access is no longer needed.
  5. Review old links periodically.

VERIFY: Never assume a private file is private simply because the link is difficult to guess.

Choose the correct sharing role

Google Drive can give people different levels of access. Do not give editing rights when viewing is all someone needs.

Click to see protection steps

Step-by-step

  1. Open the file's Share settings.
  2. Review each person's role.
  3. Use Viewer when someone only needs to read the file.
  4. Use Commenter only when comments are genuinely required.
  5. Give Editor access only when the person needs to change the file.

VERIFY: Give every person the lowest permission level that allows them to do their legitimate job.

Review shared folders

Folder permissions can affect many files at once. A shared folder therefore deserves more attention than an individual document.

Click to see protection steps

Step-by-step

  1. Review your important shared folders.
  2. Open the folder's Share settings.
  3. Review everyone who has access.
  4. Check whether the folder is restricted or broadly shared.
  5. Remove unnecessary users.
  6. Remember that files inside a shared folder can inherit its access.

VERIFY: Before placing sensitive files in a shared folder, understand who can access that folder.

Audit old shared files

Files shared months or years ago can remain accessible long after the original reason for sharing has disappeared.

Click to see protection steps

Step-by-step

  1. Search Drive for files you have shared.
  2. Prioritize documents containing identity, financial, employment or private information.
  3. Open the Share settings.
  4. Remove people who no longer need access.
  5. Disable unnecessary link sharing.

VERIFY: An old share should not remain active simply because nobody remembered to remove it.

Protect sensitive personal documents

Your Drive may contain passports, identity documents, certificates, bank records, photographs and other information that criminals can abuse.

Click to see protection steps

Step-by-step

  1. Identify your most sensitive Drive folders.
  2. Review who can access them.
  3. Avoid unnecessary public or link-based sharing.
  4. Remove duplicate copies you no longer need.
  5. Consider storing highly sensitive documents in a dedicated restricted folder.

VERIFY: Treat identity documents and financial records as high-value information.

Secure Drive on your phone

If your phone can open Google Drive, someone who gains access to the unlocked phone may also gain access to your files.

Click to see protection steps

Step-by-step

  1. Protect the phone with a strong screen lock.
  2. Keep the operating system updated.
  3. Install Google Drive only from an official app store.
  4. Avoid leaving sensitive files downloaded unnecessarily.
  5. Enable device-finding and remote security features where available.

VERIFY: Your phone should require authentication before someone can freely access your Drive.

Be careful with offline files

Google says that files made available offline are stored on the device. That means offline access introduces another place where your data must be protected.

Click to see protection steps

Step-by-step

  1. Review which sensitive files are available offline.
  2. Remove offline copies you no longer need.
  3. Protect the device with a strong screen lock.
  4. Avoid enabling offline access on a shared computer.
  5. Secure lost devices immediately.

VERIFY: Remember that a file stored offline is also data stored on that device.

Review third-party app access

Applications connected to your Google Account can receive permissions that affect your data. Remove access you no longer need.

Click to see protection steps

Step-by-step

  1. Open your Google Account security settings.
  2. Review apps and services connected to your account.
  3. Identify applications you no longer use.
  4. Remove unnecessary access.
  5. Investigate unfamiliar applications before trusting them.

VERIFY: Every connected application should have a purpose you recognize.

Watch for phishing messages about Drive

Attackers often use shared-document notifications and fake Google sign-in pages to steal credentials.

Click to see protection steps

Step-by-step

  1. Do not sign in through an unexpected link simply because it says Google Drive.
  2. Check the actual website address before entering your password.
  3. Be suspicious of urgent messages claiming a document will be deleted unless you sign in.
  4. Open Google Drive directly when possible instead of following the message link.
  5. Never give a verification code to someone who asks for it.

VERIFY: Verify the sender, the message and the destination before opening a sensitive shared document.

Protect shared documents from accidental exposure

A document can become exposed when someone changes its sharing settings or places it inside a broadly shared folder.

Click to see protection steps

Step-by-step

  1. Review important documents after collaborators make major changes.
  2. Keep sensitive files in appropriately restricted folders.
  3. Avoid giving unnecessary Editor permissions.
  4. Review link-sharing settings after collaborative projects end.
  5. Remove external collaborators when their work is complete.

VERIFY: A document's security should survive ordinary collaboration mistakes.

Understand Google's encryption

Google states that Drive files are encrypted in transit and at rest. Some Google Workspace organizations can additionally use client-side encryption.

Click to see protection steps

Step-by-step

  1. Understand that standard Drive encryption protects data while it is being transmitted and stored.
  2. If you use Google Workspace, ask your administrator whether client-side encryption is available.
  3. Understand that client-side encryption has additional requirements and limitations.
  4. Do not assume that encryption eliminates the need for careful sharing permissions.

VERIFY: Encryption protects data, but it does not prevent you from intentionally sharing a file with the wrong person.

Back up important files

Cloud storage should not be your only copy of irreplaceable information.

Click to see protection steps

Step-by-step

  1. Identify documents and photographs you cannot afford to lose.
  2. Keep appropriate backups in another secure location.
  3. Protect the backup with strong access controls.
  4. Periodically verify that important backups can actually be opened.
  5. Avoid keeping the only backup on the same device as the original files.

VERIFY: For important information, ask: if my Drive account disappeared today, do I have another safe copy?

If your Google Account may be compromised

A compromised Google Account can expose much more than Drive, including Gmail, contacts, photos and other Google services.

Click to see protection steps

Step-by-step

  1. Move to a trusted device.
  2. Change your Google Account password.
  3. Review and secure 2-Step Verification.
  4. Review recent security activity.
  5. Review signed-in devices and remove unfamiliar ones.
  6. Review third-party app access.
  7. Inspect Drive sharing permissions for sensitive files.
  8. Change passwords for other critical accounts if they may have been exposed through your Google Account.

VERIFY: Do not stop after changing your Google password. Review the entire security chain.

If your phone or laptop is lost

A lost device may contain offline Drive files or an active Google session.

Click to see protection steps

Step-by-step

  1. Use Google's device-security tools from another trusted device.
  2. Review the lost device in your Google Account.
  3. Sign out or secure the device where appropriate.
  4. Change your Google Account password if you believe the device was accessed.
  5. Review recent security activity.
  6. Check whether sensitive files were stored offline on the device.

VERIFY: Treat a lost device with an active Google session as a security event, not merely a lost piece of hardware.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Google Drive security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts