What Is a Zombie Link?

In the context of document management and client delivery, a zombie link is a shared document URL that remains active and accessible even though the project, engagement, or relationship that originally required that access has ended.

The name is deliberately evocative: like a zombie, it should be dead — but it isn't. It keeps working. It keeps giving access. And unlike a broken link, it gives no indication that anything is wrong.

How Zombie Links Are Created

Zombie links are created through the standard document-sharing workflows of almost every modern team:

• Sharing a Google Drive link via email with "anyone with the link can view"
• Putting files in a shared Dropbox or Box folder
• Sending a Notion page link to a client
• Sharing a Figma file with view access

None of these sharing mechanisms have built-in expiry. When the engagement ends, the access doesn't end with it — unless someone explicitly revokes it. And in the rush of wrapping up one project and starting the next, that revocation step almost never happens.

Why Zombie Links Are a Problem for Marketing Agencies

Ongoing IP exposure. The strategy decks, audit reports, proprietary frameworks, and methodology documents you delivered to Client A are still fully accessible to that client, potentially years later. If any of that work contains reusable templates or frameworks you also deploy for Client B, you have an exclusivity problem.

Confidential information remains accessible. During engagements, teams often share working documents that contain sensitive information: competitive analysis, pricing logic, internal assumptions. That information remains accessible through zombie links after the project ends.

Regulatory and compliance risk. For agencies working in regulated industries (finance, healthcare, legal), documents shared via zombie links can create GDPR and data protection exposure — personal data accessible to parties who no longer have a legitimate reason to hold it.

The Scale of the Problem

The zombie link problem compounds over time. A two-year-old marketing agency that averages five document shares per engagement and runs ten engagements per year has potentially 100 live links floating around from past relationships — many of which are pointed at sensitive files.

Most agencies have no visibility into this. Google Drive doesn't send you a "you still have 47 active links from 2023" notification. The access just sits there, invisible, waiting.

How to Prevent Zombie Links

Use expiry dates by default. Any time you share a document link, set an expiry date. Google Workspace supports link expiry for shared links. Make it a policy: every external link has a maximum 90-day lifespan.

Use time-bomb sharing for sensitive documents. For highly sensitive materials — IP-containing frameworks, confidential audits, pricing documents — use self-destructing access that expires the moment the document has served its purpose.

Build engagement close into your workflow. Never consider an engagement finished until you've run through a document access revocation checklist. This takes five minutes and eliminates years of zombie link accumulation.

Use a client portal with built-in revocation. Platforms like Firma route all client document access through a managed portal rather than individual links. When you close an engagement, all access is revoked in one action — no link-by-link cleanup required.

---

Frequently Asked Questions

What is the difference between a broken link and a zombie link?

A broken link returns an error (like a 404) when accessed — it no longer works. A zombie link is the opposite: it still works perfectly, but it should have been revoked. A broken link is visible and obviously dead; a zombie link is invisible and silently alive.

How do I find zombie links in my Google Drive?

In Google Drive, you can see who has access to files and folders by right-clicking and selecting "Share" or "Manage access." For comprehensive auditing, use Google Workspace Admin Console's Drive audit reports. For ongoing prevention, build a revocation step into every engagement close process.

Can you set an expiry date on a Google Drive link?

Yes — in Google Workspace Business and Enterprise plans, you can set expiry dates on shared access by going to the sharing settings for a file or folder and adding an access expiration date. However, this applies per-user access, not per-link. Using a dedicated client portal with built-in time-bomb sharing is more scalable for agencies managing multiple client engagements.