Keeping sensitive files off third-party servers

Some files you would happily pin to a noticeboard. Others you would not want a stranger to hold, even for a moment. A tax return, a passport scan, a signed contract, an export of customer records, a folder of medical results: for these it matters not only who you send them to, but which machines they pass through on the way. Keeping them off servers you do not control is mostly a matter of noticing where they slip out, because most of those moments are habits rather than choices.

This is a plain guide to keep sensitive files off servers on a Mac, without turning ordinary work into a security project.

Decide what actually counts as sensitive

You cannot protect everything with equal care, so start by naming the files that deserve it. A short mental list works: anything with an identity number, anything financial, anything medical, anything covered by a contract or an agreement with someone else, and anything that would embarrass a person if it leaked. Draft screenshots and memes do not make the list. The point is not to treat every file as secret, but to know the handful of categories where an accidental copy on someone else’s disk is a real problem.

Once the categories are clear, the rule follows: for those files, no step in a task should quietly involve a server unless sending it out is the actual goal.

Where files reach a server without you deciding

The leaks are rarely dramatic. They come from convenience.

Sending yourself a file is the most common one. You paste a document into a chat or mail it to your own address to move it to another app or another device. That is an upload, and a copy stays on the provider’s disk after the file reaches you.

Synced folders are the next. Dropping a sensitive file into a folder that syncs to the cloud, even briefly, copies it out and back. So does saving it there by default because that folder is where the save dialog happens to point.

Then there are previews and helpers you never think about: an app that uploads a document to render a thumbnail, a converter that processes your file on its own server, an assistant that reads a file to summarise it. Each is fine for public material and quietly wrong for the files on your list.

Keep the everyday moves local

Most of what you do with a sensitive file is small and local: move it from Downloads to a project folder, hand it from Finder to a terminal, drop it into the one app that is meant to receive it. None of that needs the internet, and the Mac has always been able to do it on its own.

The trick is to have a local way to set a file down and pick it up elsewhere, so you are not tempted to reach for a chat window as a courier. Ledge is built for exactly that pause: you drag a file up to the notch, it waits on a shelf, and you drag it off to its destination when you are ready. Nothing is uploaded, and the release build is blocked from shipping if the app so much as links a networking symbol, so a private file on the shelf stays on your Mac by design rather than by policy. When you do drop it on a chat app because sending it is the point, that upload is your decision, made once, not a side effect of moving the file around.

Tell a local tool from one that phones home

For the apps that touch your sensitive files, it is worth knowing which ones stay offline. A few signs help. Read the privacy page and look for a plain statement that files are processed on the device and not uploaded. Watch the app’s network activity with Activity Monitor’s Network tab or a firewall that prompts on outbound connections. Notice whether a feature that could run locally, like making a thumbnail or converting a format, takes a moment and a spinning indicator that suggests a round trip to a server.

The strongest signal is a developer who says the app cannot go online at all, and explains how that is enforced rather than just promised. That is uncommon, and it is exactly the property you want for the files that matter.

A routine you can actually keep

Security that is too much work gets dropped, so keep the routine short. Save sensitive files to a local folder, not one that syncs, unless you have chosen encrypted sync on purpose. Move them between apps with a local hand-off instead of sending them to yourself. Before you feed one to a converter, a preview tool, or an assistant, ask whether that step runs on your Mac or on someone else’s. And when a file genuinely needs to reach another person, send it once, deliberately, by a method you trust, rather than letting it accumulate copies across half a dozen services.

None of this makes your Mac a vault, and it does not need to. It just moves the sensitive files out of the quiet server detours that most tasks fall into, and keeps them on the one machine you actually control.