Agencies and consultancies live on shared folders: one Drive per client, one Slack channel, one “please upload the MSA here.” It works until a freelancer stays in the folder after the retainer ends—or a competitor brand’s assets appear in the wrong space.
This playbook shows how to run a client data room with sealed sharing—controlled delivery and revoke—without enterprise VDR overhead.
What a client room should contain
- Executed MSA / SOW and change orders
- Final deliverables and approved brand kits
- Access credentials exports (when you must share them)
- Reports with customer or revenue detail
Work-in-progress design files can stay in creative tools. The room is for frozen, sensitive packets.
Sealed-room workflow
- One client → one labeled packet set (never mix brands)
- Upload finals via client-side encryption
- Mint shares for client stakeholders with expiry matching the engagement (+ short buffer)
- Contractors get separate time-boxed access—not the client master link
- Notify with links only
- At offboarding: revoke, export activity if needed, archive your copy
Compliance Locker is built for sealed packets and revoke. Pair with contractor offboarding and NDA follow-on sharing.
Agency anti-patterns
- One Dropbox “Clients” tree with inheritance nobody audits
- Sending brand guidelines + payroll exports in the same ZIP
- Leaving last year’s retainer folder open for “easy reference”
- Using WhatsApp for signed contracts “because the client prefers it”
Minimal policy for a 10-person studio
Client legal docs, financial reports, and credential exports ship as sealed links with default expiry. Creative WIP stays in design tools. Freelancer access is time-boxed and revoked at handoff.
FAQ
Do agencies need a full VDR for every client?
Usually no. Most retainers need sealed delivery of brand assets, contracts, and reports—not an investment-bank data room. Use sealed packets per engagement and close them out when the retainer ends.
Can clients keep editing in Figma / Drive?
Yes. Collaboration tools stay for work-in-progress. Deliver finals, legal docs, and sensitive exports as sealed shares.
How do we handle multiple brands in one agency?
Separate vault spaces or clearly labeled packets per client. Never reuse one mega-folder across unrelated brands.
What about freelancers on the engagement?
Invite with roles where needed, or mint time-boxed sealed links. Offboard by revoking—see contractor offboarding.
Is WhatsApp okay for sending client proofs?
For casual comps, maybe. For contracts, financials, or PII-bearing exports—no. Chat is not a vault.
Related: vendor diligence rooms, WhatsApp / iMessage are not a vault.