Trust Center access requests

Restricted documents on your Trust Center, such as an audit report or a penetration test, are shared only with people you approve. Visitors request access on your page, accept your NDA and confirm their email address. Your team then approves or denies the request, or an auto-approval rule decides it. An approved viewer signs in with an emailed link and downloads only what they were given.

Access management is switched on per workspace. When it is on, Compliance › Trust Center has these sections: Page, Access requests, Viewers, Activity, Documents, NDA, Settings and, where switched on, Security contacts.

Set it up

1. Publish your Trust Center (Trust Center setup).
2. On Documents, add at least one document with Visibility set to Restricted.
3. On NDA, choose Create new version, write the agreement and Publish it. Requesters accept the current version before their request reaches you.
4. On Settings, turn on Access portal. It can be turned on only when the checklist under Before you turn it on is complete: Trust Center published, NDA published, At least one restricted document, and Sign-in links configured on the server. If that last item is not ticked, contact Safeguard support.

The Portal address under Settings is where approved viewers sign in; Open the portal shows it.

What the visitor does

1. On your Trust Center, the visitor chooses Request access and fills in their first and last name, Work email, Company, their relationship to you (existing customer, prospective customer, partner, auditor or other) and, optionally, a reason.
2. Under Access, they ask for Full access (every restricted document) or Limited access (only the documents they choose).
3. They accept the NDA: they read it, tick the box and type their full name exactly as entered above. Where the customer setting is on, a visitor who says they are an existing customer can choose Request access as a customer and skip the NDA.
4. They get an email and choose Confirm my email. Only then does the request reach your team. Requests whose email address is never confirmed are deleted automatically after 7 days.
5. When the request is approved, they receive a sign-in link. The link works once; after signing in they see the documents they can download and until when. An approved viewer can ask for a new link at any time with Email me a sign-in link.

Disposable email addresses are refused when the request is sent. If Refuse free email addresses is on in Settings, so are addresses from free mail providers.

Decide a request

Open Access requests. A request shows its requester, NDA acceptance, whether the email was verified, its flags and when it was sent. Flags help you decide quickly, for example Free email, Always review, Allowlisted, Existing customer, Previously denied, Already a viewer, Access was revoked, Renewal and No NDA on file.

Approve opens the approval:

• Access: Full access (every restricted document, including ones added later) or Limited access (only the documents you choose).
• Access ends: after a number of days, or On a date at least one day from now and at most two years away.
• Internal note (optional): only your team sees it.

The requester gets an email with a sign-in link, and access ends on the date shown.

Deny takes an optional Reason, sent to the requester only if you choose Email the requester. To decide many at once, select them and use Approve selected or Deny selected. An approval in bulk gives each requester what they asked for, for your default access length.

Only a compliance reviewer can decide a request (see who can approve).

Auto-approval

Under Settings › Auto-approval, rules can approve a request without a person. A rule runs only after the requester has verified their email and, when you require one, accepted the NDA. In order:

1. A domain listed under Always review these domains always waits for a person, whatever the rules say.
2. Allowlisted domains are approved.
3. Existing customer domains are approved.
4. Every verified request approves everyone who confirms their email and accepts the NDA.
5. Any business email approves any address that is not from a free mail provider.
6. Anything else waits for a person.

A domain matches its subdomains too. Access given by a rule sets whether an auto-approved viewer gets what they requested or full access, and Default access length (days) (1 to 730) sets how long it lasts.

Where switched on for your workspace, you can also list exact Customer email addresses, give matched customers full access (Customers get full access), and let customers covered by their agreement skip the NDA (Customers covered by their agreement skip the NDA). A visitor who claims to be a customer but does not match waits for a person.

Manage viewers

Viewers lists everyone who can sign in to read your restricted documents, and everyone who could. Filter by Active, Expiring in 14 days, Expired, Revoked or All. For each viewer you can:

• Change end date or Change access;
• Send sign-in link;
• Revoke: the viewer is signed out at once and can no longer open restricted documents;
• Restore revoked access until a date you choose;
• open Activity to see what they viewed and downloaded.

Remind viewers before access ends (days) (0 to 60, where 0 turns it off) emails viewers before their access expires.

Notifications

Under Settings › Notifications:

• Assignees: each is told about every request, and the first one owns its review task.
• Also notify: more addresses to tell about every request.
• Email requesters when denied: whether a denial is emailed by default.

The audit trail

Every step is recorded.

• The request (open it from Access requests) shows the requester, what they asked for, when the email was verified, the decision, and its history. The NDA acceptance records the version, the name the requester typed, when they accepted, their IP address and browser, and the agreement's SHA-256, so you can prove what was accepted.
• Activity reports requests, approval rate, median time to decision, active viewers and downloads over the last 30 days, 90 days or 12 months, with the most-read documents and most active companies. Its Access log records every action, from Request sent, NDA accepted and Email verified to Approved, Approved by a rule, Denied, document downloads and settings changes. Export it with Export CSV.
• NDA lists every version (Draft, Current or Retired) with its text SHA-256 and a PDF copy, and who accepted each version. Publishing a new version applies to new requests; existing viewers keep the acceptance they gave.

Related

• Trust Center setup
• Requests and approvals