Should You Work From a Coworking Space With Client Data?
Quick Summary
- A coworking space is not automatically unsafe. It depends on what you do there and how your device is protected.
- A Wi-Fi password does not mean your traffic is isolated from everyone else in the building.
- If you handle client records, financial data, legal documents, healthcare information, contract data, or admin access to customer systems, treat the network as untrusted.
- Use MFA, a managed and encrypted device, and an encrypted path out of the network. If you cannot do those three things, do not handle sensitive work there.
The honest answer: it depends what you do there
Checking email from a locked-down laptop is different from downloading client tax files. Writing a proposal is different from logging into a customer's Cloudflare account. Taking a general sales call is different from discussing payroll or legal strategy in a glass-walled phone booth.
Before you connect, ask this: if someone got access to this laptop, this login, or this conversation, what could they reach?
For a lot of people, the answer is more than they think. The laptop may not store much data, but the browser does. Email may not hold every client file, but it probably receives password resets. Project tools may contain links, documents, credentials, and customer context.
That is the coworking risk most people miss: the access you bring into the room.
A Wi-Fi password is not a security boundary
Most coworking spaces have better Wi-Fi than a coffee shop. That helps with speed. It does not prove isolation.
A member login, a captive portal, or a password often lets the operator identify who used the network at a certain time. That can be useful if there is abuse on the connection. It does not automatically mean every device is isolated from every other device.
In a busy space, every person brings multiple devices. Every device has its own settings, updates, apps, and problems. You do not know what is sitting three tables away.
That is why you should treat coworking Wi-Fi like any other shared network: useful, but not trusted.
The exposure is usually the account, not the file
People picture an attacker “stealing files” over Wi-Fi. That can happen, but the more practical risk is account access.
If someone compromises the login you use for client work, they may not need your laptop at all. They can sign in later, from somewhere else, and use your access like it belongs to them.
That matters for anyone who manages systems for clients: websites, DNS, email, accounting software, cloud storage, CRMs, social accounts, ad accounts, or internal tools. If your account is breached, the attacker may be able to reach your clients through you.
This is why MFA is not optional. Use app-based MFA, hardware keys, or passkeys where possible. SMS is better than nothing, but it should not be your first choice for important accounts.
Also check your permission level. If you do not need admin access every day, do not keep it every day. A breached editor account is bad. A breached owner account is worse.
The minimum setup before you work from a coworking space
If you commonly work from shared spaces, start here.
- Use a managed device for work. The device should be known, updated, encrypted, and protected. On a Mac, that means FileVault is enabled. On Windows, BitLocker or device encryption should be enabled. The screen should lock quickly. Local file sharing should be off. The operating system and browser should be current. If the laptop is personal, unmanaged, shared with family, and full of unknown browser extensions, keep sensitive client work off it.
- Turn on MFA for every important account. Start with email. Email is the reset button for almost everything else. Then protect cloud storage, password managers, website admin tools, finance tools, social accounts, and client systems.
- Use a password manager. Every important account should have a unique password. Reused passwords turn one breach into many.
- Protect the path out. Use a business VPN, Zero Trust Network Access tool, or secure access service your IT team manages. The point is not the product name. The point is that work traffic should not depend on the coworking network being trustworthy. DNS filtering is useful, but it is not the same thing as protecting the full session.
- Keep files in approved cloud storage. Do not let client files live in Downloads forever. Do not keep working copies on the desktop because it is convenient. If you must download sensitive files, know where they are, encrypt the device, and clean them up when the work is done.
- Use your own hotspot for higher-risk work. If you are accessing financial accounts, client records, admin consoles, or regulated data, a cellular hotspot is often the cleaner choice. It is not magic, and it does not fix a weak device or a weak account, but it removes the coworking network from the path.
- Do not use shared peripherals for sensitive work. Avoid shared printers, public workstations, USB hubs, keyboards, and unknown docks. If you must print, use secure print release and pick it up immediately.
- Watch the room. Use a privacy screen if you work in open seating. Take sensitive calls in a private room. Do not leave a laptop, notebook, printed document, or unlocked screen behind “just for a minute.”
This is basic discipline around data in transit, data at rest, and who can get in.
Questions to ask before you trust the space
You do not need to interrogate the tour guide. But if you plan to work there often, ask plain questions:
- Do members get individual Wi-Fi credentials, or is everyone using the same password?
- Are guest, member, private office, staff, printer, and building-device networks separated?
- Are private offices given dedicated VLANs or dedicated networks?
- Are devices isolated from other members by default?
- Who manages the network, and how often is equipment patched?
- What happens if one member reports that they can see another member's device?
If nobody can answer those questions, assume the network is built for convenience first.
That does not mean you can never work there. It means your own controls have to carry more of the weight.
When you should not work there
Some work does not belong in an open coworking area.
Do not handle sensitive work there if you cannot use MFA, cannot protect your traffic, cannot keep files off the local machine, or cannot keep the conversation private. Do not use the space for work that a client contract or regulatory obligation requires to happen only in an approved environment.
A private office helps with shoulder surfing and phone calls. It does not automatically change the network, the device, the account, or the files.
If the work would create a bad day for your client if exposed, slow down and choose the safer path.
A simple decision rule
Coworking is fine for a lot of work. It is not fine for every kind of work.
Before you open the laptop, ask three questions:
- What data or systems am I about to access?
- Is my device encrypted, updated, and protected with MFA-backed accounts?
- Is my traffic leaving through a trusted encrypted path?
If the answer to any of those is “I don't know,” that is the exposure.
