I'm surprised such a significant security gap has so few votes.
My firm was ready to adopt Box Sign (moving from Docusign), and this issue ended up being a dealbreaker for us. Sensitive documents should not be accessible through public links, especially when those links cannot be expired, revoked, or governed. Our signers reported they did not feel safe using this platform, so we had to switch back at a significant cost to us.
The article linked by Shawn only addresses security controls involved in signing the document in the first place. Such controls do not apply to the completed-document links sent after signing, which is the actual issue.
When reaching out directly, the workaround proposed to us by Box was to suppress all Box Sign notifications through the API and rebuild the entire notification process ourselves. That is not a realistic solution for most customers and is quite redundant.
Until administrators have the ability to control or disable these links, this will remain a significant barrier to adoption for organizations with strong security and compliance requirements. If Box Sign intends to compete as an enterprise-grade platform, this should be a top product priority.
Mia S.
I'm surprised such a significant security gap has so few votes.
My firm was ready to adopt Box Sign (moving from Docusign), and this issue ended up being a dealbreaker for us. Sensitive documents should not be accessible through public links, especially when those links cannot be expired, revoked, or governed. Our signers reported they did not feel safe using this platform, so we had to switch back at a significant cost to us.
The article linked by Shawn only addresses security controls involved in signing the document in the first place. Such controls do not apply to the completed-document links sent after signing, which is the actual issue.
When reaching out directly, the workaround proposed to us by Box was to suppress all Box Sign notifications through the API and rebuild the entire notification process ourselves. That is not a realistic solution for most customers and is quite redundant.
Until administrators have the ability to control or disable these links, this will remain a significant barrier to adoption for organizations with strong security and compliance requirements. If Box Sign intends to compete as an enterprise-grade platform, this should be a top product priority.