Share Private Documents and Review Viewing Activity

Choose the setup by what you are sending

Two kinds of tools do this job well. They record different things. A document-sharing service tracks a PDF or a deck page by page. A small static site behind an email gate works better for a folder of mixed files, such as CSV exports, HTML reports and Markdown notes.

What you share	Tool	What you can see afterward
A PDF, deck or contract for named people	Papermark or DocSend	Viewer email, time of each visit, time spent per page
A folder of files: CSV, HTML, Markdown, images	Cloudflare Pages with Cloudflare Access	Which email address signed in and when, page views by path
Google Docs, Sheets or Slides for colleagues	Google Drive sharing with named people	The Activity dashboard (work or school accounts only)

Whichever you choose, start with the files that the recipient needs. Leave out drafts, raw exports and anything that you do not want people to forward.

Option 1: Send a tracked document link

This route suits a document that people read page by page. The steps below use Papermark’s setting names. DocSend has similar controls under different names.

1. Upload the file. Give it a clear title with a date, for example “Q3 report, 2026-10-14”.
2. Create a link. Turn on Require email to view. Then each visit has an address that the visitor typed.
3. For stronger protection, turn on Require email verification. The visitor then must prove that they own the address. In Papermark, this setting is on the Business plan. In DocSend, email verification is only on the Advanced, Advanced Data Rooms and Enterprise plans.
4. Use Allow specified viewers to limit the link to named addresses or to the domain of a client. In Papermark, this setting is also on the Business plan.
5. Decide on downloads. If people must read the file only in the browser, leave Allow downloading off.
6. Set an Expiration Date for material that goes stale, such as a proposal with a deadline.
7. Turn on Receive email notification to get an email when someone opens the document.
8. Open the link in a private browser window. Use an address that is not on the list. Make sure that the service refuses it.

Create one link for each recipient. Name each link after the person or company. If a single link goes to five people and it leaks, you cannot tell which recipient forwarded it. Also, if you expire the link, all five people lose access.

Papermark records each view with the viewer’s email, country, time spent and page-by-page durations. DocSend’s Activity tab shows time spent per page and visitor details such as name, location and device.

Option 2: Share a folder of files behind an email code

When the material is a set of files and not one document, put the folder on Cloudflare Pages. Protect it with Cloudflare Access. Access does not use a shared password. Each visitor types an email address and receives a one-time code. The visitor gets in only if your policy allows that address.

Prepare the folder

1. Put every file that you want to share in one folder. Use subfolders if they help.
2. At the top of the folder, add an index.html that links to each file. Give each link a one-line description. Pages serves your files as they are, so visitors see this page first.
3. Add a 404.html. Without a top-level 404.html, Pages treats the project as a single-page app. Then Pages serves the start page for any unknown path, and this hides broken links.
4. Browsers open HTML, PDF and image files directly. A CSV or spreadsheet can download instead of opening. For each table that people need to read in the browser, add an HTML or PDF version.

Upload and protect it

1. In the Cloudflare dashboard, go to Workers & Pages. Select Create application, then Get started and Drag and drop your files. Name the project. Drop the folder and deploy it. Drag and drop accepts up to 1,000 files of up to 25 MiB each. For larger folders, use npx wrangler pages deploy <folder>.
2. Open the project and go to Settings > General. Select Enable access policy. On its own, this protects only the preview deployments.
3. To protect the main <project>.pages.dev address too, follow Cloudflare’s steps for the pages.dev domain:
   • Select Manage on the new policy.
   • Open the application. Select Configure.
   • Under Public hostname, remove the wildcard from the subdomain. Save the change.
   • Go back to Settings > General. Select Enable access policy again, so that the previews stay protected.
4. Edit the policy. Keep the action Allow. Add an Include rule. Use Emails for named people, or Emails ending in for a whole client domain such as @client.com (policy reference).
5. Turn on the one-time PIN login method in Zero Trust. Go to Integrations > Identity providers > Add new identity provider > One-time PIN. You do not need a separate identity provider.
6. If you add a custom domain, create a separate self-hosted Access application for it. Cloudflare warns that without this application, the login page appears but does not work for visitors on that domain.

Test it as a visitor

Open the site in a private window. Sign in with an allowed address. The code arrives by email. It expires 10 minutes after the request.

Then try an address that is not allowed. Cloudflare sends no code, but the page looks the same. So a blocked visitor gets no hint about who is on the list.

If you need a shared password instead of email codes, Netlify and Vercel offer one on paid plans. See password protection on Netlify and password protection on Vercel.

Read the activity

The folder setup gives you two records. They answer different questions.

The first record shows who came in. In the Zero Trust dashboard, open Logs and select Access authentication logs. Each entry shows the email of the user, the application and whether Cloudflare allowed access. It also shows the time, the IP address and the country. These logs record sign-ins. They do not show which files a person opened afterward.

The second record shows what people viewed. In the Pages project, go to Metrics. Under Web Analytics, select Enable. Cloudflare adds the snippet on the next deployment (guide). Then you can filter page views by path, referrer, country, device type and browser.

Web Analytics does not tie views to an email address. It also counts a page view as an HTML response. So a direct download of a PDF or CSV does not appear. If you need counts for each document, send those files as tracked document links instead.

Read both records with care. An open can come from a forwarded link, a colleague who looks on behalf of the recipient, or a mail scanner that follows links. Treat activity as a reason to follow up. Ask for approval in writing.

For Google Docs, Sheets and Slides that a work or school account owns, open the file. Go to Tools > Activity dashboard. Viewers can turn off their view history. So a missing name does not prove that someone skipped the file.

Update the shared files

• On Cloudflare Pages, open the project and select Create a new deployment. Choose production. Upload the whole folder again, not only the changed file.
• Keep file names stable. Some people possibly bookmarked a direct link to report.pdf, and a new name breaks it.
• Archive the exact copy that a client approved, with its date, outside the shared folder. Then a replaced file does not erase the record of what the client accepted.
• When the project ends, remove the addresses from the Access policy or delete the Pages project. Let the document links expire.

Mistakes to avoid

• Do not send a password in the same email as the link. Anyone who gets that email gets both. Send the password by another channel.
• Do not send one link to everyone. If it leaks, you cannot tell who passed it on. Also, if you turn it off, every recipient loses access.
• Do not protect only the previews. Enable access policy covers preview URLs. In a private window, make sure that the main pages.dev address and any custom domain also ask for a code.
• Do not leave extra files in the folder. Anyone who passes the gate can open every uploaded file, whether index.html links to it or not.
• Do not treat a view as proof of reading. A page view or an open shows that a page loaded. It does not show that someone read it or agreed with it.

A docs portal with Ask AI
and support tickets

Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets.

• Publishes from GitHub on every push
• Works with Mintlify repositories
• API console from your OpenAPI file
• MCP server and llms.txt for AI agents
• Ask AI and support tickets
• Analytics for people and AI agents

Start Free→ Questions? Ask AI in our docs

No card required.