Document security / How long it lives, and what happens after
Responding when a document goes to the wrong recipient
The response to the most common document incident, where the technical options are limited and the decisions are mostly about scope and disclosure.
The exposure
A document reaching the wrong person is a disclosure, and the response is largely determined by decisions made before it happened. Whether it can be withdrawn depends on whether it went as a link or an attachment. Whether the scope can be established depends on whether an audit trail exists. Whether it can be prevented from happening again depends on whether the cause was a template, a loop or a data problem, which requires knowing what was actually sent. None of those are answerable in the first hour unless the groundwork exists.
The decisions
Reasons rather than a description of the code. Each one has a default that is fine for a page and wrong for a file somebody keeps.
- Establish the scope first: how many documents, to whom, containing what. That is the input to every other decision and it comes from the audit trail.
- Withdraw what can be withdrawn immediately. A link can be revoked; an attachment cannot, and knowing which within minutes matters.
- Stop the source before investigating it, because a running batch continues sending while the investigation proceeds.
- Preserve the evidence: the exact documents sent, not regenerated equivalents, because a regenerated document may differ from the one that went out.
- Treat notification as a decision with a clock on it, made by people who own that decision, and give them the scope quickly rather than perfectly.
- Distinguish the three usual causes, because the fix differs: a wrong recipient address, a wrong document for the right recipient, or a template exposing data it should not.
In practice
A fragment, with the thing that goes wrong kept in a comment where it is the more instructive half.
/* The first hour, in order. Every step depends on groundwork:
1. SCOPE, from the audit trail. Not from a guess.
SELECT document_id, subject_id, actor, detail
FROM audit
WHERE action = 'document.delivered'
AND at BETWEEN ? AND ?;
How many, to whom, containing what.
2. WITHDRAW what can be withdrawn. This is decided by a choice made
months ago:
sent as a link revoke now, and it stops working
sent as an attachment it cannot be recalled. Move to
notification.
3. STOP THE SOURCE before investigating. A running batch keeps
sending while you look at it.
4. PRESERVE the exact documents that were sent, not regenerated
equivalents. A regenerated document may differ from the one that
went out, and the one that went out is the evidence.
5. NOTIFY, as a decision with a clock, made by the people who own it.
Give them the scope quickly rather than perfectly.
6. CAUSE, which is one of three and the fix differs for each:
wrong address for the right document delivery or data
wrong document for the right address a loop or a lookup
right document, too much on it the template */
async function haltAndScope(runId, window) {
await runs.pause(runId); // step 3, first
const sent = await audit.find({ action: "document.delivered", at: window });
await evidence.snapshot(sent.map((s) => s.documentId)); // step 4
return sent; // step 1
}What people do instead
Regenerating the documents to see what was sent. The template, the data or the code may have changed since, so the regenerated version can differ from the one that was delivered, and the investigation is then working from the wrong artefact.
How this is found out
Almost always by a recipient telling you, which means the disclosure is already established and the clock on any notification decision has already started.
Frequently asked
Does this page tell me what the law requires?
No, and deliberately not. Retention periods, erasure obligations and residency rules vary by jurisdiction, by industry and by the kind of document, and they change. What these pages describe is the shape of the problem and the mechanisms a system needs in order to implement whatever answer your own advisers give you. Where a genuine tension exists, such as an immutable record against a right to erasure, it is named as a tension rather than resolved.
Why is so much of this about the contents rather than access control?
Because access control decides who can obtain a copy and has no opinion at all about what happens to the copy. Once a document is on somebody's laptop, forwarded to a colleague or printed, every control listed here has already stopped applying to it. What is inside the file is therefore the part that keeps mattering, which is the opposite of the balance you would strike for a page.
How much of this applies at a small volume?
Most of it, because these are decisions rather than infrastructure. Redacting by omitting rather than covering costs nothing. Deciding what goes on a template costs one review. Classification is one object in code. Legal hold and an audit trail are the two that take real work, and both are far cheaper to build before they are requested than under the deadline that comes with the request.
Related security topics
The decisions that depend on each other, then the rest of the same group.
Revoking access to a document you already delivered
The difference between a link that stops working and a document that cannot be reached, which people conflate until they need one of them urgently.
Recording who generated, accessed and shared each document
The record of what happened to a document and who did it, which is asked for after an incident and cannot be reconstructed then.
Keeping one customer's documents away from another's
The controls that stop a multi-tenant document system delivering one organisation's document to another, which is the worst failure available to it.
Deciding how long to keep a document, and proving it was deleted
The period a document remains available and the mechanism that removes it afterwards, where the second half is the one that is usually missing.
Erasing a person's data when the document is a financial record
A genuine conflict between a person's right to have their data removed and a business's obligation to retain records, which is resolved by policy rather than by a library.
Every document security topic
The full list, grouped by access, contents and what happens afterwards.
What this API actually does
The options and endpoints these decisions are built on, one page each.
Most of these are decisions rather than features, and the cheapest time to make them is before the first document is delivered rather than after one reaches the wrong person.