Attachments / File Storage: Configurable file access controls for organizations with stricter compliance policies
under review
E
Emmanuel Aviles
Business Problem:
- Files shared through respond.io are accessible via direct URL indefinitely
- This follows industry best practices — URLs are not guessable or enumerable, storage does not permit directory listing, and the architecture meets the security standards under which respond.io is independently certified and audited by third parties, including ISO 27001.
- However, some organizations in regulated industries (banking, insurance, healthcare) have internal policies or regulatory expectations that require additional controls beyond industry best practices. These customers need the ability to enforce their own stricter access rules within the platform.
Desired Outcome:
Organization or Workspace-level settings allowing Admins/Owners to:
- Configure a URL expiration window (e.g. 24h, 7 days, 30 days), after which the file URL returns access denied
- Optionally require authentication to access file URLs
Trade-off:
Recipients who don't download within the active window lose access permanently. Authenticated access would require a different delivery mechanism for end contacts who do not hold respond.io accounts.
Hever Admin
To add to my previous comment: Having a publicly available link, even if it expires, is still a security risk as the whole point of having such a link in the first place is to share it between people/systems. It can be unintentionally leaked/exposed when shared like this. Requiring authentication/authorization will minimize the risk.
N
Nabilah Binti Salleh
Hever Admin: Hi Hever, appreciate you raising the point about authenticated access.
To clarify how file access works today: files shared through the platform are accessible only via their exact, complete URL.
These links are not guessable or enumerable, and our storage does not permit directory listing. This means that files cannot be discovered or browsed by anyone who doesn't already have the specific link.
This architecture is standard in our industry and meets the security standards under which respond.io is independently certified and audited by third parties, including ISO 27001 and is consistent with our GDPR obligations.
The relevant documentation is available in our Trust Center. If you'd like further information on this, you can email us at privacy@respond.io for further clarifications :)
Hever Admin
Nabilah Binti Salleh Thank you. I've registered at the trust center, as we might need your certifications for our own security audits.
S
Shi Hui
updated the status to
under review
Hever Admin
I would add that access to the files should only be for authorized parties (a logged in user if via an app or the browser, or an API call with authorization headers)