Control "Send page" feature to prevent sending emails to external email addresses?

[mschwirzke]

Is there a way to control the "Send page" feature at the space-level, so a space admin can prevent users from sending page(s) to external email addresses? (That is, prevent Wiki users from accidentally -- or intentionally -- sending sensitive, corporate content to an external email address).

Thanks!

[Mirek · Accepted solution]

Hi @mschwirzke ,

That does not look like a OOTB feature for Confluence Server. Is there any addon that you are aware of using?

[mschwirzke]

Thanks, Mirek -- I appreciate you confirming what I suspected is the likely case (i.e., not a feature currently available in / native to Confluence).

As far as macros, plugins, scripting, etc. that will allow space admins to disable the "Send page" feature, I'm not aware of any.

It'd be helpful if the feature could be controlled through the "Restrictions" setting (e.g., granting view-only permission allows Wiki users to view content, but not send pages via email). 

[Mirek]

Yes, I agree. All that kind of option should be configurable if not page by page then at least on the space level so that we are sure that nothing sensitive is sent.

However overall I think if someone want to send something he can always take a screenshot or export to Word/PDF and do the same so if we care about security we should think about this from a little bit different perspective.

[mschwirzke]

Sounds like we're both on the same page ... I'll do some investigating to see if anyone has formally added this request as an Open Issue, so I can comment and add my vote.

Going forward, we'll likely add a confidentiality statement as a footer to each page in the Wiki space, so users are reminded not to copy, send, etc. sensitive information.

Thanks again for your help -- it's much appreciated!

[Veronica Burton]

I agree that this feature should be configurable at the space level (or at least restricted to our internal company email addresses). Although anyone can take a screen shot of any page and send, disabling the feature sets a clear security protocol to all system users that the feature is not available because it's not acceptable to share information.

My concern is that by leaving this feature "wide open" we send the wrong message that it's okay to share content outside the approved user base, because if that were not an accepted practice, the feature would not be available.

[Mirek]

Yes it is mostly a business decision that depends on specific defined policy.

I guess that if not on applications level these kind of features that are using company email servers to send notifications could be also blocked/filtered on the server side somehow. Maybe IT can disallow sending emails to different domains for Confluence outgoing email.