Client Data at a Shared Desk: What Has to Be True Before You Log In

Start with the task, not the building

Reading email on a locked-down laptop and pulling down a client’s tax files are not the same activity. Neither are drafting a proposal and signing in to a customer’s DNS provider, or taking a routine sales call and talking through payroll or legal strategy inside a glass phone booth.

So the useful question, before you join the network, is this one: if somebody got hold of this laptop, this login, or this conversation, what would they be able to reach?

Most people underestimate the answer. Maybe the laptop itself holds very little, but the browser holds a lot. Your inbox may not contain every client file, yet it is almost certainly where password resets land. Project tools tend to collect links, documents, credentials, and background on customers.

The part of coworking risk that gets overlooked is the access you walk in with.

It is your accounts that are exposed, more than your files

The usual mental picture is someone on the same Wi-Fi “stealing files.” It can happen. Account access is the more realistic problem.

Once someone has the login you use for client work, your laptop stops mattering to them. They can sign in next week from another city and act as you.

Anyone who runs systems on behalf of clients should take this seriously. That covers websites, DNS, email, accounting software, cloud storage, CRMs, social accounts, ad accounts, and internal tools. A breach of your account can become a route to your clients.

MFA is therefore a requirement. Where you can, use app-based MFA, hardware keys, or passkeys. SMS beats having nothing, but for accounts that matter it should not be your first pick.

Look at your permission level as well. Admin rights you do not need daily should not be attached to your account daily. Losing an editor account hurts. Losing an owner account hurts more.

Why a Wi-Fi password proves very little

Coworking Wi-Fi is generally better than coffee shop Wi-Fi. That is a statement about speed. It says nothing regarding isolation.

A member login, a captive portal, or a shared password often does one thing: it lets the operator tell who was on the network at a given time, which helps if someone abuses the connection. It does not, by itself, wall off each device from all the others.

A full room means several devices per person, each with its own settings, patch level, apps, and problems. You have no idea what is running on the machine two desks over.

Shared network, same rule as any other: use it, do not trust it.

What to have in place first

For anyone who works from shared spaces regularly, this is the baseline.

1. Do work on a managed device. It should be known, updated, encrypted, and protected. FileVault on for a Mac. BitLocker or device encryption on for Windows. A screen that locks quickly, local file sharing switched off, and a current operating system and browser. A personal laptop that is unmanaged, shared with family, and loaded with browser extensions nobody remembers installing is not the place for sensitive client work.
2. Put MFA on every account that matters. Email comes first, because email is how nearly everything else gets reset. After that: cloud storage, password managers, website admin tools, finance tools, social accounts, and client systems.
3. Run a password manager. Each important account gets its own password. Reuse is how a single breach becomes several.
4. Secure the route out. That means a business VPN, a Zero Trust Network Access tool, or a secure access service managed by your IT team. Which product is beside the point. What matters is that your work traffic does not rely on the coworking network being trustworthy. DNS filtering helps, but it does not protect the whole session.
5. Leave files in approved cloud storage. Client files should not settle permanently in Downloads, and working copies should not pile up on the desktop for convenience. When you do have to download something sensitive, know where it went, have the device encrypted, and delete it once the job is finished.
6. Bring your own hotspot for riskier work. For financial accounts, client records, admin consoles, or regulated data, a cellular hotspot is often the cleaner option. It will not rescue a weak device or a weak account. It does take the coworking network out of the picture.
7. Skip shared peripherals for sensitive work. That includes shared printers, public workstations, USB hubs, keyboards, and docks you know nothing about. If printing is unavoidable, use secure print release and collect the pages right away.
8. Pay attention to who is around you. In open seating, use a privacy screen. Move sensitive calls to a private room. A laptop, notebook, printout, or unlocked screen should never be left alone, not even “just for a minute.”

All of this comes down to ordinary care about three things: data on the move, data sitting still, and who is able to sign in.

What to ask the operator

There is no need to cross-examine whoever gives you the tour. If you expect to be a regular, though, a few direct questions are reasonable:

1. Does each member get their own Wi-Fi credentials, or does everybody share one password?
2. Are the guest, member, private office, staff, printer, and building-device networks kept apart?
3. Do private offices get dedicated VLANs or dedicated networks?
4. Are members’ devices isolated from one another by default?
5. Who runs the network, and how often does the equipment get patched?
6. If a member reports that they can see someone else’s device, what happens next?

When no one on staff can answer, assume the network was designed for convenience first.

You can still work there. Your own controls just have to do more of the job.

Work that should stay out of the open area

Some tasks do not belong at a shared table.

Hold off on sensitive work if you cannot use MFA, cannot protect your traffic, cannot keep files off the local machine, or cannot keep a conversation private. And if a client contract or a regulatory obligation says the work must happen only in an approved environment, a coworking space is not where it happens.

Renting a private office solves shoulder surfing and overheard calls. The network, the device, the account, and the files are the same as they were at the open desk unless you change them.

When exposure would mean a very bad day for your client, take the slower, safer route.

Three checks before you open the lid

Plenty of work is fine in a coworking space. Some of it is not. To tell which is which, run through these before the laptop opens:

1. Which data or systems am I about to touch?
2. Is this device encrypted and updated, and are my accounts backed by MFA?
3. Does my traffic leave through an encrypted path I trust?

An answer of “I don’t know” to any of the three is the exposure.