Security Definitions and Policies

When a rule saves attachments to cloud storage and puts links in the email, a Security Definition decides who can open those links, whether they expire, and whether they need a password. A Security Policy picks a different definition for different emails, for example password-protected links when the email contains personal data and public links otherwise. This page explains the built-in presets, how to create your own definitions and policies, and how to use them in a rule.

Before you begin

• Connect the storage provider the definition is for. Each provider supports a different set of options. See Link Security Options by Provider.
• For a Security Policy, create the variables its conditions will test. See Custom Variables.

How they fit together

A rule uses either one definition (or preset) for every email, or a policy that chooses a definition per email.

Built-in presets

The presets appear at the top of Auto Filling › Security Definitions, marked Preset. Click one to see its settings. You can't edit or delete them.

Create a Security Definition

1. Open Auto Filling › Security Definitions and click Create. The Add a security definition dialog opens.

2. Enter a Definition name.

3. In Choose your cloud storage, choose the provider: Box, Google Drive, OneDrive, Egnyte, Dropbox for Teams or mxHERO Shares. Egnyte also covers Egnyte Gov.

4. Under Link access permissions, choose who can open the links:

   • Accessible to anyone (Public links)
   • Accessible to the recipients of the email: recipients get access to the file or to a folder for each sender–recipient pair, and must sign in to the provider.
   • Accessible to people in the organization (Company)
   • Accessible to the folder collaborators (no shared link): no link is created; only people who already have access to the folder can open the file.
   • Accessible to individual user with authentication (External): mxHERO Shares only; the recipient signs in with an emailed code, Google or Microsoft.

5. Turn on the options you need. Only options the provider supports for the chosen access are shown.

   Option	What it does
   Enable automatic expiration of Mail2Cloud links	Links stop working after the number of Days you enter. For mxHERO Shares it is on by default at 365 days, which is also the maximum.
   Prevent file downloads	Recipients can view files but not download or open them in their original format.
   Remove file downloads link	Leaves out the separate direct-download link for replaced attachments.
   Password Protected	Recipients need a password to open the links. mxHERO generates the password and sends it to the recipients in a separate password notification.
   Collaboration role (Box, recipient access only)	The role recipients get on the shared folder: Co-owner, Editor, Viewer or Previewer. Default Viewer.

   

6. Click Create.

The new definition appears below the presets in Auto Filling › Security Definitions, and in the rule's Select a security option list as Security definition: .

Password strength is set organization-wide in Settings › Integrations › Storage settings › Storage Link Password Settings. See Storage Overview.

Note: Senders can also request a password-protected email on demand with the #pass shortcode, when the rule allows it. See Password-Protected Emails.

Provider support at a glance

Full details, including how each provider creates recipient access: Link Security Options by Provider.

Create a Security Policy

1. Open Auto Filling › Security Policies and click Create.

2. Enter a Policy name (up to 100 characters) and, optionally, a Policy description (up to 500).

3. In Choose cloud storage, choose the provider. Only definitions and presets for that provider can be used.

4. In #1 Policy Condition:

   1. In When these variables:, choose one or more variables.
   2. Choose how they must match: All match, At least one match or No Match.
   3. In Apply the security definition, choose a preset or one of your definitions. Do not upload files is also offered.

   

5. To add more cases, click Add Condition. Conditions are checked in order, and the first one that matches decides the definition.

6. Turn on Use a default condition and choose the definition for In any other case apply the security definition. Always set a default.

7. Click Save policy.

The policy appears in the rule's Select a security option list as Security policy: .

Warning: If no condition matches and the policy has no default definition, the rule fails for that email. Always set a default condition.

Match modes

A variable "matches" when its condition is met. A variable that falls back to its default value does not match.

Use a definition or policy in a rule

1. In the rule wizard, go to 3. Cloud Storage and choose the storage account.

2. In Select a security option:, choose:

   • Accessible to the folder collaborators (no shared link),
   • a Preset,
   • or type in Search a security policy or definition and choose a Security policy: or Security definition: item.

   

3. Click Confirm.

Where the option is shown:

• Protect Attachments, Secure Emails and Zip Attachments: in the main Cloud Storage card.
• Copy Emails and Move Emails: under Advanced Options.

Some combinations limit the list:

• Forwarding Address and User Mailboxes rules can use only Public access links and Organization access links (or no link).
• Rules that send the same copy to all recipients can't use Accessible to the recipients of the email options.
• Zip Attachments rules use mxHERO Shares and default to 7 days expiration public access links.

Example: stricter links for personal data

1. Create a variable Contains SSN that matches \b\d{3}-\d{2}-\d{4}\b in Message Body and Attachments Text. See Regular Expressions.
2. Create a Box definition Box password 7 days: Accessible to anyone (Public links), expiration 7 days, Password Protected.
3. Create a Box Security Policy:
   • Condition 1: Contains SSN, All match → Box password 7 days
   • Default: Organization access links or Public access links
4. In your Protect Attachments rule, choose Security policy: .

Edit and delete

• Changes to a definition or policy apply to links created afterwards. Links already sent keep the settings they were created with.
• If a definition or policy is used by a rule or policy, the dashboard lists them with links when you try to delete it. Change those items first.

Verify

1. Send a test email that the rule processes.
2. Open the link in a private browser window as someone who should, and someone who shouldn't, have access.
3. For password-protected links, check that the password notification arrives.
4. For a policy, send one email that matches each condition and one that matches none, and check which link type each gets.

Troubleshooting

Related pages

• Link Security Options by Provider
• Custom Variables
• mxHERO Shares Link Types and Security
• Protect Attachments
• AI Question Conditions