Testing confidential document access

Test confidential board papers through every route a person might use: draft, published pack, repository, direct link and download.

Use separate accounts for people who should see the paper and people who should not. A restricted folder alone does not establish that the same paper is restricted when placed in a meeting pack.

Set the access rule

Prepare harmless papers with distinctive titles: one for the whole board and one for a committee. Define who may find, open, annotate, download and share each. Include a board secretary, a committee member, a director outside that committee and an invited outsider.

If you need a closed item within a wider meeting, specify exactly which attendees should see it before asking whether the proposed portal can meet that rule.

Test with separate sign-ins. An administrator preview may miss access granted through another membership or invitation.

Check the documented controls

BoardPro describes board-only repository folders. Its ordinary board-pack notice goes to people with the relevant login access. Its help page says Executive/Guest users cannot receive that notice or access board-pack documents through that role. BoardPro also documents a separate outside sharing route for one specified pack.

That shared link expires after 30 days unless revoked earlier. The help page says the shared pack cannot be downloaded through that route. These distinctions do not establish paper-level restriction within a pack.

Ask to see how a committee paper is kept out of a wider board pack and what an outside recipient can see.

BoardEffect describes private folders, libraries with user permissions and committee workrooms. Ask an administrator to show the effective membership and grants for each test paper. Public feature pages do not establish the permissions in your proposed account.

Document Access Restrictions in Board Portals

Change access and check again

Publish the harmless papers through the intended route. Sign in as every test role and try the pack, repository, search and a copied link.

If an authorised user may download a file, save a harmless copy and record that it exists.

Then remove the committee member or outside recipient through the proposed process and repeat the online checks.

Revoking portal access cannot retrieve a separate file someone already saved or forwarded.

Record each role, route, expected result and observed result during a future demonstration.

Accept the configuration only when intended readers can work and excluded users have no unintended route to the confidential paper or revealing details.