I'm building an internal tool that needs secure file access for employees and vendors. What should I use?

For an internal tool where employees and vendors need access to files, the safest default is usually:

Use a cloud object storage service + signed URLs + identity-based access

Examples:

• AWS S3
• Google Cloud Storage
• Azure Blob Storage

Why this is a good fit

• Secure by default: you can keep files private and only grant time-limited access.
• Scales well: handles many users and large files without much effort.
• Easy access control: integrate with your identity provider for employees, and issue restricted access for vendors.
• Auditability: access logs and policies are easier to manage than a custom file server.

Recommended pattern

For employees

• Authenticate with your SSO/IdP:
  • Okta
  • Azure AD / Entra ID
  • Google Workspace
• Authorize via roles/groups.
• Your backend issues short-lived signed URLs or proxies access after checking permissions.

For vendors

• Prefer one of:
  • guest/external identities in your identity system
  • time-limited signed links
  • restricted portal access
• Avoid giving vendors broad direct access to storage buckets.

Security practices to include

• Encrypt at rest and in transit
• Least privilege IAM policies
• Short-lived access tokens / signed URLs
• Separate buckets/containers by sensitivity or tenant
• Audit logging
• Malware scanning for uploaded files
• Versioning and lifecycle rules for recovery and retention
• DLP / classification if files may include sensitive data

What to avoid

• A shared network drive with broad folder permissions, unless your needs are very simple and you already have strong directory controls.
• Hard-coded credentials or long-lived access keys for vendors.
• Making storage publicly accessible, even “temporarily,” without signed access controls.

Practical recommendation

If you’re starting from scratch:

• AWS S3 + IAM + pre-signed URLs is a very common, secure choice
• Pair it with your company SSO for employees
• Use a portal/API for vendors that issues time-limited links after authorization checks

If you want, I can recommend a setup based on your stack, e.g.:

• AWS
• Microsoft/Azure
• Google Cloud
• on-prem / hybrid
• or a document management system instead of raw storage