The Security Questions a Client’s IT Team Will Ask About Your Link
Sooner or later a proposal lands somewhere that has a security function, and a link to a domain nobody recognises gets escalated. The questions that come back are always more or less the same eight, and the deal is not usually lost on the answers. It is lost on vagueness.
So here are the eight, with straight answers — including the four where the honest answer is that the thing they are asking for does not exist.
1. “Can this link be guessed or enumerated?”
The real question underneath is whether somebody could walk the URL space and find other customers’ documents.
A Quixli share link carries a token generated from 128 bits of cryptographically random data, rendered as a 22-character URL-safe string. It is not derived from a document identifier, a sequence or a timestamp, so knowing one token tells you nothing about any other, and the space is far too large to search. This is the answer to give and it is usually the answer they wanted.
2. “Is the link itself the access control?”
Largely, yes — and it is better to say so than to imply otherwise. A public link is a bearer credential: whoever holds it can open the document. That is the same model as every "anyone with the link" share in every major suite, and security teams know it.
What matters is what you can put in front of it and how quickly you can take it away. Every share supports an expiry date, a maximum number of views and immediate revocation. If a link goes somewhere it should not have, revocation is the control, and it takes effect at once.
3. “What about the PIN — is that a password?”
No, and do not let anyone believe it is. A share PIN is four to six digits. Treat it as a speed bump that stops a link pasted into the wrong channel from being casually opened, not as a cryptographic barrier — a short numeric code is not a serious obstacle to anybody determined, and you should assume it is not.
The unguessable token is the secret. The PIN is a courtesy control on top of it. Any security review that is told otherwise will find out, and finding out is worse than being told.
4. “Will this show up in a search engine?”
Share routes are disallowed in the site’s robots.txt, for general crawlers and for a list of named AI crawlers. Well-behaved crawlers respect that. But be precise with a security team, because they will be: robots.txt is a request, not an access control, and there is no noindex header on the share routes themselves. A crawler that ignores it is not stopped by it.
The actual protection is that the token is unguessable and therefore never discovered in the first place, plus your ability to revoke. That is a defensible answer. Claiming the link is hidden from search by policy alone is not.
5. “What does it collect about our people?”
This is the one where a straight inventory wins the room. When it was opened, how long each visit lasted, how many visits, a random per-browser identifier in a first-party cookie, the IP address, and the user agent. An email address only if the reader signed in or typed one into a gate. No scroll tracking, no referrer, no browser fingerprinting, no third-party enrichment. The full both-columns version is in what a tracked link actually collects, and forwarding that is a better answer than paraphrasing it.
Two facts land particularly well with a security reviewer: the city lookup runs against a local database rather than by sending the reader’s address to an external service, and the IP is truncated after 30 days so what remains points at a network rather than a machine.
6. “Where is the data, and who processes it?”
Answer with your posture, and be honest about the limits. Data is encrypted in transit. There is no data-residency guarantee — no "your data stays in the EU" commitment — and the privacy policy says explicitly that information may be transferred to and processed in other countries. There is no published subprocessor list.
If your client has a residency requirement, that is a real blocker and you should find out at the start rather than at the end. Discovering it during a security review is the expensive way.
7. “Do you have SOC 2, ISO 27001, or a DPA?”
The honest answers: no SOC 2 report and no ISO 27001 certification. A processing agreement under GDPR Article 28 is the thing to ask for, and asking for it in writing is a reasonable request from any tool you put client data through — a bad answer to that request is itself information.
If the client is an enterprise with a mandatory certification requirement, no amount of good faith substitutes. Know that before you build a quarter around them. For most freelancers and small teams sending proposals to other small and mid-sized companies, this question either never arrives or is satisfied by the specifics above.
8. “Is there SSO, and can we audit access?”
No SAML or enterprise SSO. Sign-in is a password or Google, with optional one-time codes. There is also no customer-facing audit log — you can see who read a document you shared, which is the product, but there is no tenant-wide access trail of the kind an enterprise security team means by "audit log".
Saying this plainly costs less than it seems to. What loses trust is a vendor answer that gestures at "enterprise-grade security" and turns out, two weeks into procurement, to mean none of the things the phrase implies.
How to handle the conversation
- Answer in specifics, immediately. A reviewer is trying to close a ticket. Token entropy, expiry, revocation and a data inventory close it; "it’s totally secure" does not.
- Volunteer the limits before they find them. Every item above that reads badly is one you should raise yourself. The reviewer who discovers a gap you concealed stops evaluating the tool and starts evaluating you.
- Offer the alternative. If the link is genuinely not acceptable to them, send a PDF. Losing the read signal on one deal is a smaller loss than losing the deal.
- Set an expiry on anything that went to a security-conscious client. It is the single control that most reliably reassures, and it costs you nothing.
If the question came from your contact rather than from a reviewer, it is a different conversation with a different tone — what to say when a client asks if you are tracking them has that one. The controls available on each share — expiry, view cap, PIN, revocation, the email gate — are documented in full.