Is a local network safer than cloud storage?

For confidentiality it can be: data that never leaves your building cannot be exposed by a cloud-provider breach or a mis-shared public link. But local sharing has its own risks — open shares, no authentication, no backup — so it is only safer if it is configured properly. The two threat models are different, not one strictly better.

Can someone outside my office reach my shared files?

They should not be able to if your router does not forward SMB ports (139/445) to the internet and you have no misconfigured VPN or port-forward. Verify from outside the network. Anything that transfers strictly on the LAN, like Oxolan, has no internet-facing surface at all — there is nothing outside the building to reach.

Are files encrypted when they move across my own network?

Not automatically. Plain SMB traffic on the LAN can be unencrypted unless SMB signing/encryption is enabled. Apps that transfer over their own protocol can encrypt by default — Oxolan uses TLS 1.3 with certificate pinning on every transfer, so files are encrypted machine-to-machine even inside your network.

How to Know If Your Files Are Safe on a Local Network

The Core Safety Question

"Are my files safe on a local network?" depends on three separate things:

Can people outside the office access them? (external exposure)
Can the wrong people inside the office access them? (internal access control)
Are they protected against loss? (backup and redundancy)

A local file share that satisfies all three is genuinely safe. Most small office configurations satisfy only the first — and even that is not always deliberate.

Are Your Files Accessible From Outside the Office?

By default: no. Your office router uses NAT (Network Address Translation), which means your internal machines are not directly reachable from the internet. Any device on the internet sending a packet to your office IP address hits the router — not your file server.

Exceptions that break this:

Port forwarding rules on your router (check: router admin panel → Port Forwarding or Virtual Server — should be empty unless deliberately configured)
A VPN that exposes the LAN to remote devices (intended — check what the VPN's split tunneling settings are)
Remote Desktop or remote management tools that someone has set up and forgotten
RDP port forwarding (port 3389) — this is a known target for automated attacks

Quick check: visit canyouseeme.org from your office network and check ports 445 (SMB), 139, and 3389. If any show "Success," those ports are exposed.

On your router: Look for a list of "Port Forwarding" or "Virtual Server" rules. There should be none relating to SMB, RDP, or file sharing unless intentionally configured.

Are Your Shared Folders Accessible to Everyone on Your WiFi?

If your WiFi is open or uses a widely-shared password, anyone who connects to it has access to your internal network — including shared folders with loose permissions.

Check:

Is your WiFi WPA2 or WPA3 secured?
Does your office have a guest WiFi (separate from staff WiFi) that clients and visitors use?
Is the guest network isolated from the main LAN? (router admin → Guest Network → Client isolation: enabled)

Without a separate guest network: a client who visits your office and connects to your WiFi has LAN access and could discover and browse your shared folders.

The next question: if someone is on your LAN (a staff member, or a visitor on your WiFi), can they access your shared folders without credentials?

Check:

Open Network and Sharing Centre → Advanced Sharing Settings → All Networks
Confirm "Password protected sharing" is On
Test from another machine: browse to \\HOSTNAME\ShareName without entering credentials — if it connects without prompting, authentication is off

If authentication is off, anyone on your WiFi network can browse your shared folders.

The fix: Enable password-protected sharing. Add local accounts for each authorised user on the host machine.

Can Staff Access Files They Should Not?

Internal access control is the most commonly overlooked security layer. A shared folder with one set of permissions is all-or-nothing — anyone with access can see everything.

For sensitive data (HR files, payroll, contracts, individual client information):

These should be on a separate share with permissions restricted to the people who legitimately need them
Do not rely on the assumption that "the team trusts each other" — this is about having auditable, separable control

Windows: Advanced Sharing → Permissions → remove Everyone → add only specific accounts with appropriate level (Read Only or Full Control)

NAS: ACL → per-user, per-folder permissions → staff can be given access to project folders without access to admin or financial folders

Are Files Protected Against Hardware Failure?

A RAID array is not a backup. This is one of the most important things to understand about data safety on a local network.

RAID 1 (mirroring) copies data to two drives simultaneously — if one drive fails, the other continues. RAID 5 distributes data across three or more drives with a parity block — one drive can fail without data loss. Both protect against hardware failure in the moment. They do not protect against:

Accidental deletion (deleted from both drives simultaneously)
Ransomware (encrypts all drives including the mirror)
Controller failure (damages data on both drives simultaneously)
Fire or theft (the RAID enclosure leaves the building with both copies)

Genuine protection requires:

At least one copy of the data that is physically separate from the primary copy
Regular verification that backups are intact and restorable

Minimum backup setup for a small office:

Primary: the shared folder (NAS or shared machine)
Backup 1: a second external drive or backup NAS that updates nightly (Synology HyperBackup, Windows Backup, or similar)
Backup 2: an encrypted cloud backup (Backblaze B2, Wasabi, Cloudberry) for offsite recovery

Are File Transfers Encrypted?

For data passing between machines on your local network via file transfer tools:

Tool	Transfer encryption
Windows SMB 3	Encrypted by default between modern Windows machines
Windows SMB 2	Not encrypted by default
Oxolan	Encrypted in transit
LocalSend	HTTPS (encrypted)
FTP (FileZilla)	No encryption by default; SFTP is encrypted

On a private office network inaccessible to outside parties, unencrypted LAN traffic is a low practical risk for most small businesses. For high-sensitivity data (medical records, legal documents, financial data), encrypted-in-transit tools provide additional assurance.

The Quick Safety Assessment

Rate your current setup:

External ports 445, 139, 3389 are closed (verified via canyouseeme.org)
WiFi is WPA2/WPA3 secured with a strong password
Guest WiFi is separate from staff WiFi and isolated from the LAN
Password-protected sharing is enabled on file shares
Sensitive folders have restricted access (not visible to all staff)
Data has an offsite backup (not just on the same physical device)
Backup has been tested with a file restore in the last 90 days

If you can tick all seven: your files are well-protected. Missing any of the first four means there is a real access risk worth addressing.

Get Oxolan for Windows — transfers without exposing shares to the network