In QBO, you have the ability to attach source documents to transactions.  When you do this, the file is actually uploaded into your database and stored in the same location.  It does not appear as a link to an external source.
Anyone with access to that transaction in the file, has access to the source document.

Updated: March2017