Link Security Options by Provider – mxHero Help Center

When a rule replaces attachments with links, a Security Definition sets who can open the links, whether they expire, and whether they need a password. Each storage provider supports a different set of these options. Use this page to choose a provider and a link type that work together.

Link access types

These are the access options in a Security Definition (Auto Filling › Security Definitions).

Access option	Who can open the link
Accessible to anyone (Public links)	Anyone who has the link. No sign-in.
Accessible to people in the organization (Company)	People signed in to the storage provider as members of your organization.
Accessible to the recipients of the email	Only the email's recipients, who are given access to the file or a per-recipient folder and must sign in.
Accessible to individual user with authentication (External)	Only the specific recipient, after signing in with an emailed code, Google or Microsoft. mxHERO Shares only.
Accessible to the folder collaborators (no shared link)	No shared link is created. People who already collaborate on the folder can open the file.

Support matrix

Option	Box	OneDrive / SharePoint	Google Drive	Egnyte / Egnyte Gov	Dropbox	mxHERO Shares
Public links	Yes	Yes	Yes	Yes	Yes	Yes
Company links	Yes	Yes	Yes (sender's domain)	Yes	Yes (team)	Yes (your domains)
Recipients of the email	Yes	Yes	Yes	No	Yes	No
Individual user with authentication	No	No	No	No	No	Yes
Expiration	Yes	Public and Company links only	Recipient links only	Yes	Yes	Yes
Password	Public links only	Public links only	No	No	Yes	Public links only
Prevent download (view only)	Public and Company links	No	No	Yes	Yes	No
Remove download link	With prevent download	No	No	Yes	Yes	No
Collaboration role for recipients	Co-owner, Editor, Viewer, Previewer	Fixed by mxHERO	Fixed by mxHERO	Not applicable	Fixed by mxHERO	Not applicable
Link to folder instead of each file	Yes	Yes	Yes	Yes	Yes	Yes
Separate download link	Yes	Yes	Yes	No (view link only)	Yes	Yes

The dashboard only shows options the selected provider supports.

Built-in Security Definitions

These ready-made definitions are available without setup.

Name	Access	Expires	Password	Providers
Public access links	Public	No	No	All
7 days expiration public access links	Public	7 days	No	All except Google Drive
Recipients access links	Recipients of the email	No	No	Box, Google Drive, OneDrive/SharePoint, Dropbox
7 days expiration recipients access links	Recipients of the email	7 days	No	Box, Google Drive, Dropbox
Organization access links	Company	No	No	All
Password protected access links	Public with a password	No	Yes	Box, Dropbox, mxHERO Shares
Authenticated access links	Individual user with authentication	No	No	mxHERO Shares

When you create a new Protect Attachments or Secure Email rule, the dashboard preselects Accessible to the folder collaborators (no shared link). Check the Security Option before you save the rule. When you select mxHERO Shares as the storage, and for Zip Attachments rules, the default is 7 days expiration public access links.

Provider notes

Box

Recipient links add each recipient as a collaborator on a folder named <sender>-<recipient> inside the path, with the role from the Security Definition (default Viewer).
Expirations must fit your Box enterprise's limits, or links won't open. See Recommended Box Settings.

OneDrive and SharePoint

Recipient links invite each recipient to the file without a Microsoft invitation email. The recipient signs in with Microsoft to open it. For recipients outside your tenant, mxHERO creates a Microsoft Entra B2B guest account first, so your tenant must allow guest sharing.
Expiration is available for Public and Company links. With OneDrive for organizations, mxHERO also removes the permission when it expires.
Public links need Anyone sharing allowed in SharePoint; Company links need organization sharing; recipient links need guest sharing. See Connecting OneDrive and SharePoint.
Recipient roles: Co-owner maps to full control, Editor to write, Viewer and Previewer to read.

Google Drive

Company links are shared with the sender's Google Workspace domain.
Recipient links give each recipient read access without a Google notification email. If Google refuses, mxHERO retries with Google's notification email.
Expiration is available only for recipient links. If a folder in the path already shares the file through inherited permissions, Google may refuse to set an expiration (shown in Email Flow Logs as an inherited-permission error).
Passwords and prevent download are not available.

Egnyte and Egnyte Gov

Recipient (collaborator) links are not available. Use Public or Company links.
If your Egnyte domain enforces a link expiration policy, mxHERO uses it automatically.
Egnyte gives a view link only, with no separate download link.

Dropbox

Dropbox Business (team) accounts only.
Company links are shared with your Dropbox team.
Password-protected links change the link audience to "password".

mxHERO Shares

Authenticated access links are available only here: the link opens only for the intended recipient after they sign in with an emailed code, Google or Microsoft (set in mxHERO Shares › Settings).
Links without an expiration still follow your Shares retention: they expire after 365 days with One Year retention, and don't expire with No expiration retention.
A password set on an Authenticated or Company link is not requested. Use passwords with Public links only.
Recipient (collaborator) links aren't available.

See mxHERO Shares Link Types and Security.

Choose a link type

You need	Use
External recipients without accounts, simplest experience	Public links with an expiration
External recipients without accounts, stronger protection	Password-protected Public links (Box, Dropbox, mxHERO Shares), or Authenticated links (mxHERO Shares)
Only the named recipient may open the file	Recipient links (Box, OneDrive/SharePoint, Google Drive, Dropbox) or Authenticated links (mxHERO Shares)
Internal sharing only	Company links
Archive copy with no new sharing	Folder collaborators (no shared link)