Who has a copy of last quarter’s board pack right now? If you send packs by email or post them to a SharePoint folder or shared drive, you probably can’t answer with certainty.
This guide shows you how to compare those channels with a purpose-built board portal on 8 security criteria. By the end, you’ll know whether a SharePoint board portal setup is enough for your board, or whether it’s time to move.
Why where you share board packs is a governance decision
The way you share board packs is usually chosen for convenience. Directors already have email. IT already runs SharePoint. The pack goes out on time.
The trouble starts later, when someone asks for proof. A regulator wants the full record of a meeting. A shareholder’s lawyer files a books-and-records demand. A director’s laptop goes missing the week before results.
In 2019, the Delaware Supreme Court made those stakes concrete. In KT4 Partners v. Palantir, it held that a company which conducts formal business over email, without documenting it in minutes and board resolutions, “has no one to blame but itself” when those emails must be produced to a shareholder (Potter Anderson case summary). The tool you choose shapes the record you’ll be asked to hand over.
As the corporate secretary’s governance role widens, so does personal accountability for that record. So the useful question is simple: if your board materials were challenged tomorrow, could you show who received what, which version they read, and where every copy is now?
Where email, SharePoint and shared drives fall short
Each of these tools does its own job well. None was designed around how a board works: a small group of insiders and outsiders, highly sensitive papers, fixed meeting dates and a record that has to hold up years later.
Email: you lose control the moment you hit send
An emailed pack becomes a set of independent copies. One sits in each recipient’s inbox, on each synced phone and in each backup.
- No reliable way to pull back a pack sent to the wrong address
- No record of who opened which attachment
- A corrected deck means a second email, and 2 versions in circulation
- Forwarding takes one click
Password-protecting the PDF helps less than it seems. The password often travels in a follow-up email or gets reused meeting after meeting.
SharePoint and shared drives: secure only while someone keeps them that way
SharePoint can be configured carefully. Permissions, sensitivity labels, audit logging and retention policies all exist in the Microsoft 365 stack. The catch is that each one depends on configuration, licensing and an IT team that understands board confidentiality.
Folder permissions also drift. A committee member steps down, an external adviser gets a link for one deal, a new director lands in the wrong group. On a shared drive, nobody owns that cleanup by default.
Patching matters too. The breach at the UN, reported in January 2020, began with a SharePoint server flaw (CVE-2019-0604) that Microsoft had fixed in April 2019 but UN IT staff hadn’t installed, according to The New Humanitarian’s investigation. Dozens of servers in Geneva and Vienna were compromised. Our breakdown of how the UN SharePoint breach unfolded covers the full sequence.
That incident involved on-premises servers. A cloud tenant shifts much of the patching responsibility to Microsoft, but access design and sharing settings remain with you.
Directors’ personal email: the gap nobody owns
Non-executive directors who sit on several boards often read papers on personal accounts and devices. Once a pack lands in a personal Gmail or iCloud inbox, your organization may no longer control its retention, access logging, or deletion.
That creates 2 exposures. Board papers can contain personal data, such as executive pay or employee matters, so data protection obligations, including those under the GDPR, may still apply to that copy. In litigation, a director’s personal account can become subject to discovery.
Ask yourself: if a director left the board tomorrow, how would you retrieve or remove the packs they hold?
Know who opened every board paper, and when:
See board-grade access control
How to assess whether your setup is secure enough
Is SharePoint secure enough for board packs? It can be if your IT team restricts each paper to named directors, logs every access, keeps packs off personal email, and enforces retention. Those controls take continuous effort on a general collaboration tool. A board portal is built to hold them by default.
Use these 8 criteria to score your current setup. Mark each one as ✓ covered, ⚠ covered with effort or ✗ missing.
A side-by-side test for your board pack process
| Criterion | What to ask | SharePoint or shared drive |
Purpose-built board portal |
|
|---|---|---|---|---|
| 1. Access control | Can you restrict one paper to named directors? | ✗ Whoever has the email has the file | ⚠ Possible with folder and file permissions, which drift over time | ✓ Set per document, member and committee |
| 2. Encryption | Is the pack protected in transit, at rest and on devices? | ⚠ Depends on both mail servers, then on each device | ⚠ Protected in the cloud, but downloads leave that protection | ✓ Covers transit, storage and offline copies |
| 3. Version control | Does every director read the same final version? | ✗ Each correction is a new attachment | ⚠ Version history exists, but directors may work from downloads | ✓ Updates replace the paper in place, history kept |
| 4. Audit trail | Can you show who opened what, and when? | ✗ No read record | ⚠ Audit logs exist if enabled and licensed | ✓ Activity and access logs per document |
| 5. Offline access | Can directors read securely on a plane? | ⚠ Yes, as loose copies | ⚠ Synced or downloaded copies outside your control | ✓ Encrypted offline copies inside the app |
| 6. Retention and deletion | Can you remove packs when a director leaves? | ✗ Not from their inbox | ⚠ From the site, not from downloads | ✓ Access revoked centrally, downloads can be blocked |
| 7. Personal email exposure | Can packs reach personal accounts? | ✗ Yes, whenever directors use personal addresses | ⚠ Sharing links can be forwarded | ✓ Directors sign in, nothing goes out as an attachment |
| 8. Liability and evidence | Could you defend the record before a regulator or court? | ✗ Record scattered across inboxes | ⚠ Depends on configuration history | ✓ Papers, votes and minutes kept together |
If your current setup has 2 or more ✗ marks, treat it as an open governance risk and put it on the next audit committee agenda.
When SharePoint is enough, and when it stops being enough
A SharePoint board portal setup can work. It tends to fit when:
- You run one board with no committees that require separate confidentiality controls
- Every director is an employee on your corporate tenant
- IT reviews permissions before every meeting
- Board papers carry little personal or market-sensitive data
It stops fitting when:
- Independent or external directors join
- Audit, remuneration or nomination committees need papers others can’t see
- You’re listed, regulated or preparing a transaction
- A director wants to read offline on a personal tablet
- Someone asks you to prove who accessed a paper
If 2 or more items in the second list apply, maintaining a board-grade SharePoint setup becomes a standing IT project.
How to choose between email, SharePoint and a board portal in 5 steps
You don’t need a 6-month selection process. You need a clear view of your exposure and the people who can block a decision.
- Map where every copy of your last pack lives. Inboxes, synced folders, printouts, personal devices. This is your real perimeter.
- Score your current setup against the 8 criteria above. Be strict about “covered with effort”. Effort fails during holidays and staff changes.
- Name the costly moment. A regulator request, a books-and-records demand, a director departure, a leak. Which one would expose you first?
- Bring IT and security in early. They’ll ask about hosting location, certifications, single sign-on and data residency. Get those answers before you shortlist.
- Test with your most demanding director. If the director who reads everything on a tablet between flights can use the tool comfortably, you’ll have tested it against one of the board’s most demanding use cases.
What a purpose-built board portal changes for your secretariat
A board portal won’t fix a weak governance process. What it does is make the secure option the default, so you no longer rely on every director, IT ticket, and folder setting working as intended.
Here’s what that looks like in DiliTrust’s board portal software, based on its documented capabilities.
Access follows the board, not the folder tree
Each board or committee works in its own room. Administrators set view, download, print and watermark rights per user or team on each folder or document, using “everyone except” or “nobody except” rules.
One practical point from the field: a newly added document is visible to everyone in the room by default. Set restrictions on remuneration or audit papers before you upload them.
Need an outside adviser for a single meeting? Occasional attendees can join a specific meeting without seeing the rest of the board’s material.
Every director reads the current version
When you upload a corrected paper, the new version replaces the old one on the same agenda item. Directors see the latest version and can tell it changed. Earlier versions stay available, and annotations carry over.
Where the option is enabled, users with editing rights can open a paper in Word, Excel or PowerPoint from the portal and save straight back. Each saved change is recorded in the audit trail, so there’s no download-edit-reupload loop creating stray copies.
Offline reading without loose copies
Directors can read, annotate and vote offline on iOS and Android, and their changes sync once they reconnect. Offline documents are encrypted with AES-256 on the device. If your policy forbids offline storage, an administrator can switch it off for the whole organization.
Download, print, and copy-paste can be disabled by default, with a custom watermark on the documents directors view. Printing can still be allowed for a specific member who needs a paper copy.
A record you can produce when asked
Activity and access logs show who opened which document. Votes, annotations, and minutes sit next to the papers they relate to, instead of being spread across every director’s inbox.
The platform encrypts data in transit (TLS 1.2 and 1.3) and at rest (AES-256). DiliTrust holds ISO 27001 and ISO 27701 certifications and has a SOC 2 Type II attestation. Access is protected by two-factor authentication or SAML single sign-on. For the steps before and after distribution, from agenda building to archiving, see our guide to managing board packs end to end.
Frequently asked questions
These are the questions corporate secretaries and directors raise most often when comparing these options.
Can I use SharePoint as a board portal?
Yes, with careful setup. You’ll need strict permissions, audit logging, controlled external sharing, and regular reviews. SharePoint doesn’t provide board-specific workflows for agendas, votes, director annotations, or minutes out of the box, so you’d need custom development or third-party tools to add them.
Is it safe to email board papers?
Email delivers the pack. It can’t revoke a sent pack, record who opened it, or stop forwarding. If you must use email, send a notification that points to a controlled location rather than the pack itself.
What security features should a board portal have?
At a minimum, look for permissions per document, member, and committee; encryption in transit, at rest, and on offline copies; two-factor authentication or single sign-on; download, print, and watermark controls; activity and access logs; version control on agenda items; and recognized certifications such as ISO 27001 and SOC 2.
What happens if a director forwards board papers to a personal email?
The copy leaves your retention rules, access logs and deletion controls. Depending on its content, it can trigger data protection obligations and become discoverable in litigation. Cover it in the board’s information security policy, then remove the need to email packs at all.
Is a board portal more secure than a shared drive?
For board material, generally yes, when the portal provides document-level controls, audit trails, and meeting-specific workflows by default. A tightly governed shared drive can narrow the gap, but only with ongoing IT effort and discipline from every director.
The test is the request you haven’t received yet
Email, SharePoint and shared drives all deliver the pack. The difference shows up months later, when someone asks you to prove who saw a paper, which version they read and where the copies went.
Score your current setup against the 8 criteria this quarter, before your next board date. If the gaps sit on access, audit trail or personal email, the fix is a board portal built for how your board actually works.
Send your next board pack without losing track of a single copy
