Inside the office Wi-Fi, your phone reaches the file server exactly like a PC does. Outside the office, the safe door is a VPN — any other door you build will eventually be found by the wrong people.
Two different problems get mixed up under “files on my phone”. At the office, the phone is just another network client and SMB apps handle it in minutes. From home or the road, the phone must first join the office network securely — and that means a VPN, full stop. This page does the easy part properly and explains why the tempting shortcut is the most dangerous setting in small-office IT.
On iPhone and iPad, the built-in Files app has Connect to Server: enter smb://FILESERVER, sign in with the same server account as the PC, and the permitted folders appear. On Android, solid file managers (the built-in one on many brands, or established apps like Solid Explorer or Cx File Explorer) add an SMB/LAN location the same way. Permissions behave exactly as on a PC — a phone logged in as a Read-group user can look but not delete, which is precisely what you want in a pocket-sized device.
A VPN makes the phone a temporary member of the office network, so the same smb://FILESERVER address simply works — from home, a client site, or a hotel. For small offices the practical choices are Tailscale (built on WireGuard, free for small teams at the time of writing, almost no configuration — install on the server and the phone, sign in, done) or a WireGuard/OpenVPN server on the office router where the hardware supports it. Either way the file server itself stays invisible to the internet; only the encrypted VPN door faces outward, protected by its own strong keys.
The internet is scanned continuously for open SMB ports, and an exposed file server is found within hours, not weeks. SMB has a long history of critical vulnerabilities, and even a fully patched server with a strong password faces endless automated login attempts and zero-day risk with your entire office data as the prize. Port forwarding 445 (or 139) to the file server, or switching on a router's "share over internet" feature for office data, converts your network into a target. No deadline justifies it — if files are needed outside, the VPN takes fifteen minutes to set up.
Give phone access to people who need it, with their own accounts — never a shared "mobile" login whose password lives on six devices forever. When a phone is lost, disable that person's account or remove the device in your VPN admin page first and ask questions later. And set expectations: phones are for viewing, approving and quick edits; the heavy work stays on PCs, where backups and versions behave predictably. That is not bureaucracy — a phone auto-"cleaning" its downloads folder against a synced location is a real way offices lose files.
The video keeps the servers themselves LAN-based and shows the clients connecting — watch how the same folders appear on different devices.
▶️ Watch Full VideoTailscale has offered a free tier covering small teams (a handful of users and more devices than a small office has) — check the current limits on their site before you standardise on it. WireGuard set up manually is completely free forever, at the cost of more configuration. Either is safe; the comparison is convenience, not security.
You can — as a deliberate hybrid, where one folder is cloud-synced for travel. The mistake is the accidental hybrid: the whole server exposed “temporarily”. Choose per folder, keep accounts data on the LAN-plus-VPN side, and never let a sync tool become an unmonitored second copy of everything.
Yes — saved credentials in the phone's keychain are acceptable for your own device, because the phone itself is locked. What you should not do is save the office admin password on a staff phone; personal accounts only, so a lost phone means disabling one account, not re-keying the whole office.