How Zombie Links Are Quietly Destroying Your Client Relationships

There's a category of document security problem that almost no marketing agency talks about, even though virtually all of them have it. It doesn't announce itself with an error or a breach notification. It just sits there, quietly. We call it the zombie link problem.

What Is a Zombie Link?

A zombie link is a document sharing URL that continues to work after the purpose it was created for has ended. The engagement is over. The client relationship has concluded. The project was wrapped up months ago. But the Google Drive link you sent in that email? It still works. The PDF you shared via Dropbox? Still downloadable. The strategy deck you put in a shared folder? The former client can still open it right now, today.

Unlike a standard broken link (which gives a 404 error and is at least obviously dead), a zombie link is worse because it works. The client doesn't know they shouldn't still have access. Your team doesn't know they still have access. The access just... persists.

Why Zombie Links Are More Dangerous Than You Think

They outlive the legal protections you negotiated. Your contract said the client couldn't use your proprietary frameworks after the engagement ended. But the Google Drive link doesn't know that. The technical access exists independent of the legal agreement.

They grow over time. Every engagement you run creates new shared links. Without a system for revoking them at engagement close, you accumulate zombie links linearly. A three-year-old agency might have hundreds of active links to documents from relationships that ended years ago.

They can damage relationships with future clients. If you share a "proprietary" framework with Client B that you previously shared (via a zombie link) with Client A — and Client A and Client B ever compare notes — the exclusivity of your approach collapses entirely.

They expose work-in-progress and internal commentary. Not every document shared during an engagement is polished. Some contain internal notes, pricing logic, strategic debates, or assumptions that you'd never want a client to see again in a calmer moment.

How to Find Your Zombie Links

Google Drive has a relatively buried feature: "Manage access" on a folder level. Go to your client folders, click "Share," and look at who has access. You'll likely find email addresses of people you haven't spoken to in months or years.

But this is manual and doesn't scale. The structural fix is to never create links that can become zombies in the first place — by routing all client document delivery through a portal that has access revocation built into the engagement close process.

The Engagement Wrap: The Zombie Link Antidote

The most effective defence against zombie links is an explicit engagement wrap step. Before you consider an engagement "done," run through a revocation checklist:

• All Google Drive share links revoked or expiry dates set
• Client portal access converted to view-only or closed entirely
• Any individual file shares sent via email identified and revoked
• Deliverables archived in a read-only reference format for your own records

Firma's "Wrap" feature does this in one click — converting the client portal to view-only, revoking all active sharing permissions, and creating a clean archive. It turns what should always have been a deliberate step into an unavoidable one.

---

Frequently Asked Questions

What is a zombie link in document sharing?

A zombie link is a shared document URL that remains active and accessible after the project, engagement, or relationship that originally required it has ended. The term reflects the idea that the link should be "dead" but continues to function.

How do I find and revoke zombie links in Google Drive?

In Google Drive, you can check sharing permissions per file or folder by clicking "Share" and reviewing who has access. For systematic revocation, use the "Manage access" panel. However, for teams sharing many documents across many engagements, a dedicated client portal with built-in access revocation is more reliable.

Can a former client still access documents I shared via Google Drive link?

Yes — if you shared a Google Drive link and never explicitly revoked it or set an expiry date, the link remains active indefinitely regardless of whether the engagement has ended. This is one of the primary reasons marketing agencies should use time-limited sharing links or portal-based delivery.