Attachments / File Storage: Time-limited access to files sent or received through connected channels
under review
E
Emmanuel Aviles
Business Problem
Files shared through respond.io are accessible via direct URL indefinitely. For some organizations in regulated industries, files remaining accessible long after a conversation ends may not meet their compliance requirements.
Current behavior
- File URLs do not expire
- Files cannot be discovered by iteration — direct URL must already be known
Proposed feature
Organization or Workspace level setting allowing Admins/Owners to configure a URL expiration window (e.g. 24h, 7 days, 30 days), after which the attachment URL returns access denied.
Trade-off
Recipients who don't download within the active window lose access permanently.
Hever Admin
To add to my previous comment: Having a publicly available link, even if it expires, is still a security risk as the whole point of having such a link in the first place is to share it between people/systems. It can be unintentionally leaked/exposed when shared like this. Requiring authentication/authorization will minimize the risk.
S
Shi Hui
updated the status to
under review
Hever Admin
I would add that access to the files should only be for authorized parties (a logged in user if via an app or the browser, or an API call with authorization headers)