Document security / Who can reach the document
Sending a document as a link or as an attachment, and the tradeoff
Two delivery models with different security properties, where the convenient one is usually the less controlled one.
The exposure
An attachment leaves your control completely and immediately: it is in a mailbox, on a backup, on a phone, forwarded, for as long as anyone keeps it. A link keeps the document on your side, which preserves revocation, expiry and an access record, and costs the recipient a round trip and sometimes a login. Teams choose attachments because recipients prefer them and then discover they have no way to withdraw a document that was sent in error.
The decisions
Reasons rather than a description of the code. Each one has a default that is fine for a page and wrong for a file somebody keeps.
- Prefer a link where the document is sensitive or where withdrawal might ever matter, because an attachment cannot be recalled.
- Prefer an attachment where the document is the point of the message and the recipient needs it offline, such as an invoice going to an accounts department.
- Where you send a link, make it require authentication if the recipient has an account, and a short-lived signed link only if they do not.
- Never send a long-lived unauthenticated link in an email as a convenience. The email outlives the link's usefulness by years.
- Record which model was used per document, because the answer to can we withdraw this depends on it and nobody remembers.
- Consider sending both deliberately: a link for the record and an attachment for convenience is a choice, and it inherits the weaker of the two properties.
In practice
A fragment, with the thing that goes wrong kept in a comment where it is the more instructive half.
/* The tradeoff, made per document kind rather than per message.
attachment
+ arrives with the message, works offline, no login
- cannot be withdrawn, ever
- lives in mailboxes and backups indefinitely
- forwarded without your knowledge
link
+ revocable, expirable, and access is recorded
+ the document stays on your side
- a round trip, and possibly a login
- a bare link in an email is a bearer credential */
const DELIVERY = {
invoice: "attachment", // accounts departments need the file
payslip: "link", // sensitive, and withdrawal may matter
medicalReport:"link", // sensitive, always
marketing: "attachment",
};
// And record which was used, because "can we withdraw this?" depends on
// it and nobody remembers six weeks later.
await audit.record({
action: "document.delivered",
documentId,
method: DELIVERY[kind],
to: recipient,
});What people do instead
Attaching everything because recipients prefer it. The preference is real and the consequence is that a document sent to the wrong address cannot be recalled, which turns an ordinary mistake into a disclosure with no remedy.
How this is found out
At the moment somebody asks to withdraw a document, which is the moment it is too late if it went as an attachment. That question is the reason to record the delivery method.
Frequently asked
Does this page tell me what the law requires?
No, and deliberately not. Retention periods, erasure obligations and residency rules vary by jurisdiction, by industry and by the kind of document, and they change. What these pages describe is the shape of the problem and the mechanisms a system needs in order to implement whatever answer your own advisers give you. Where a genuine tension exists, such as an immutable record against a right to erasure, it is named as a tension rather than resolved.
Why is so much of this about the contents rather than access control?
Because access control decides who can obtain a copy and has no opinion at all about what happens to the copy. Once a document is on somebody's laptop, forwarded to a colleague or printed, every control listed here has already stopped applying to it. What is inside the file is therefore the part that keeps mattering, which is the opposite of the balance you would strike for a page.
How much of this applies at a small volume?
Most of it, because these are decisions rather than infrastructure. Redacting by omitting rather than covering costs nothing. Deciding what goes on a template costs one review. Classification is one object in code. Legal hold and an audit trail are the two that take real work, and both are far cheaper to build before they are requested than under the deadline that comes with the request.
Related security topics
The decisions that depend on each other, then the rest of the same group.
Signed URLs for documents, and choosing an expiry that fits
Giving out a URL that carries its own authorisation for a limited time, which moves the access check to the moment the link is minted rather than the moment it is used.
Responding when a document goes to the wrong recipient
The response to the most common document incident, where the technical options are limited and the decisions are mostly about scope and disclosure.
Personal data in a document that will be emailed
What a document discloses once it is attached to a message, which is more than the recipient asked for and travels further than the message.
Serving a generated document behind proper access control
Making sure the person downloading a document is entitled to it, which fails most often because the document lives somewhere the check does not.
What belongs in a document filename, and what must not
The name the recipient sees, which travels further than the document's contents and is visible in places the contents are not.
Every document security topic
The full list, grouped by access, contents and what happens afterwards.
What this API actually does
The options and endpoints these decisions are built on, one page each.
Most of these are decisions rather than features, and the cheapest time to make them is before the first document is delivered rather than after one reaches the wrong person.