The Hidden Risk of Shadow Data in OneDrive and Google Drive

Cloud folders are convenient precisely because they copy files for you. Save a document on one computer and it appears on another. The same convenience is how one sensitive file becomes several: a copy on the office desktop, one on the manager's laptop, one on a home computer signed in to the same account. This is shadow data, information that exists in places nobody chose and nobody tracks.

Why synced folders hide so much

• Nobody decided to put it there. A file saved to "Documents" on a machine where Documents is synced goes to the cloud without a conscious choice.
• It outlives its purpose. A folder shared for one project stays synced long after the project ends.
• It crosses boundaries. Work files can end up in personal accounts or on devices that are not managed by the office.
• Deleting is not simple. Removing a file in one place does not always remove the copies elsewhere, and a deleted item may sit in a recycle bin for a while.

Picture a small bookkeeping office. A client emails a scanned W-9 and a bank statement. The owner saves them to her synced Documents folder, then opens them on a laptop at home. The office now has the originals in the mail system, a copy on the desktop and a copy on the laptop, and no list that mentions any of them.

Why it matters for compliance

Rules like PCI DSS, the FTC Safeguards Rule and state privacy laws all assume you know what data you hold and where. The Safeguards Rule, for instance, asks covered firms to identify and manage their data, personnel, devices, systems and facilities. GDPR can also apply to US businesses that offer goods or services to people in the EU or monitor their behavior there. If you cannot say where regulated data is, you cannot say it is protected, and that gap is itself something a reviewer will notice. This is general education; ask your attorney or advisor how it applies to you.

How to see it

Files that are synced down to a computer can be scanned there; files kept online only are not on the disk, so they are not read. Scanning those local folders shows how far sensitive files have spread, without needing a separate look inside every cloud account. MyVaultMate runs on each computer as a small program that runs in the background and scans on the schedule you set, on Windows 10 and 11 and on Linux, and scans the local drives, the synced folders you choose and external disks. You pick which folders are included and can remove any of them at any time. The default scan skips AppData and caches, so it is not wading through application junk.

It looks for Social Security numbers and ITINs, payment card numbers, labeled driver's license, passport and date-of-birth values, medical record numbers, Medicare numbers, health insurance member IDs and provider NPI numbers, and a health-information keyword signal. Each finding records the file path, the kind of data, a severity, the frameworks involved and at most a short redacted sample. The files and the full values stay on the machine and are never stored.

Cleaning up without breaking things

1. Look at the by-computer view to see which machines hold the most. The same document appearing on several machines tells you where the sprawl is.
2. Pick one canonical home for each type of document and move needed files there. This is manual work or your IT provider's task. MyVaultMate only reports. It deletes nothing and moves nothing on its own.
3. Remove the extra copies, including the ones in synced folders, and check the cloud recycle bin if it matters.
4. Set a simple rule for staff: client documents go in the shared client folder, not in personal Documents or Downloads.
5. Re-scan on a schedule. New organizations start with hourly incremental scans, which is a good default for catching copies as they appear.

This week

Ask every person which cloud accounts are signed in on their work computer, and whether any are personal. Then scan one machine and look at what the synced folders hold. Most offices learn something from that single look.