Secure file upload portal for Google Drive

A secure file upload portal is a private page people can send files through without an account, where each sender sees only their own upload box and never the folder behind it. Drive File Request gives you one per link, and delivers every upload into a folder inside your own Google Drive.

The word “secure” gets attached to anything with a login screen, so it is worth being concrete. For collecting files from people outside your organisation, the security that matters is mostly about isolation and control: senders should not be able to read, rename, or delete anything, you should be able to decide who can open the page at all, and the link should stop working when the work it belonged to is over.

A shared cloud folder fails all three at once, which is why it is the wrong tool for the job even though it is the one most people reach for first. An upload portal is the narrower, safer shape: a page that only accepts, never reveals.

• Accountants and bookkeepers gathering statements, receipts, and tax documents from clients who will not create an account to hand them over.
• Freelancers and studios taking brand assets, raw footage, and revisions from clients on a per-project basis.
• Agencies collecting deliverables and source files from several clients at once, where one client seeing another's folder is an actual incident.
• Recruiters and HR teams receiving CVs, portfolios, and signed paperwork from candidates who have no internal account yet.
• Vendors, suppliers, and partners sending documents into a company that does not want to add them to its identity provider.
• Anyone running an intake process — legal, insurance, applications — where submissions arrive from strangers.

1. 01Sign in with your Google account and create a link. This is the only sign-in involved anywhere in the flow.
2. 02Set the controls for that link: password, allowed senders, expiry, size and count limits, file types, and any questions you want answered at upload time.
3. 03Send the link by email, chat, or however you already talk to the person. Nothing is installed and nothing is invited.
4. 04They open a single upload page, drop the files in, and answer whatever you asked. No account, no sign-up, no app.
5. 05The files land in a folder inside your own Google Drive, owned by you, optionally in a subfolder created for that submission.

The shared-folder column is the one worth staring at. “Anyone with the link can edit” is the standard workaround for Google Drive's missing file request feature, and it hands every sender edit rights over everything already in that folder — the background is in does Google Drive have a file request feature.

Most tools sold as secure file sharing for business are two-directional and priced per seat: everyone in the company gets an account, files move both ways, and the security model is built around managing those accounts. That is the right shape when the people exchanging files all work for you. It is the wrong shape, and an expensive one, when what you actually need is for people outside the company to hand you documents.

This is the narrower tool for that second case. There are no seats to license, no accounts to provision for people who will use them once, and no shared workspace to keep tidy — one flat price, and a link per request. The tradeoff is deliberate and worth stating plainly: it will not distribute files outward, so if you need both directions you need something else alongside it. What it removes is the usual reason inbound collection is insecure, which is that someone opened a folder to the world because provisioning an account for a client was too much work.

Access control decides who may upload. Secure file transfer is the separate question of what happens to the bytes between the sender's browser and your Drive, and it is worth knowing rather than assuming:

• Uploads go directly from the sender's browser to private storage over TLS. They are never public and never listed anywhere.
• The transfer into your Drive runs as a durable background job using Google's resumable upload protocol in 8 MB chunks, so a dropped connection resumes rather than restarting — which is what makes large files arrive at all.
• The temporary copy in staging is deleted once Google Drive confirms the file has landed. The finished file lives in one place, your Drive, not two.
• Google tokens are encrypted before they are stored, and the app holds only the narrow drive.file scope described above.
• Uploads are rate limited per link and per sender without raw IP addresses being stored, and completed submissions are recorded as audit events you can review.

It is worth being clear about the boundary, because “portal” is used loosely. This is not a client portal with accounts, dashboards, and a login for the people you work with — the whole design goal is that senders never have an account. There is no message thread, no approvals workflow, and no e-signature step. If what you need is a place clients log in to and live in, this is the wrong shape of tool. If what you need is a safe, controlled way for them to hand you files, it is exactly the right one.