Last updated:

Tresorit as a secure shared folder

Website
tresorit.com
Documentation
support.tresorit.com
I use it for
Report and documents available for viewing by all parties, during the assignment.

Sometimes parties mainly need to be able to view the report and the documents, not take them away. Then I share a secure folder in Tresorit instead of sending a medium. It is simply a clear tool to keep people from downloading, while they can still consult the data.

An ordinary share link from a cloud service allows downloads and does not record who opened what. With a shared file you need exactly that information: sooner or later the question comes up whether the other party really received and viewed the preliminary report.

Handing data to a single recipient is different. There downloading is the point, and a link with a PIN and an expiry date is enough, see Boomerang.

Why not a virtual data room

A virtual data room can do all of this, but quickly costs several hundred euro a month (Papermark, Peony). For an assignment worth a few thousand euro that is too much. Article 5 of the code of conduct asks you to limit costs to what is absolutely necessary for the assignment.

I only take Tresorit temporarily, as long as I have a case that needs it, and then the cheapest plan that lets you share whole folders. That costs something like thirty euro a month. The FileSharing plan is not enough for that. If you want to try a larger plan first, cancel the FileSharing trial first, otherwise you cannot start the new trial. Check the current rates, because they change.

Article 15 of the same code asks for technical and organisational measures against viewing by unauthorised persons. A shared folder with access control meets that, a public link does not.

Three settings

They are in the Link settings of the shared folder. They belong to the link, not to the folder: if you share the same folder twice, you set them twice.

  • Disable download. Parties view the documents in the browser, without a copy on their own drive.
  • Allowed viewers. Only the email addresses you enter yourself get in. Choose this, not Require email to view. That option does ask for a verified email address, but lets in anyone who has the link forwarded to them.
  • Detailed access logs. Per opening the time, the type of action, the email address, the IP address, the country and the city. You can export the log and attach it to the report, as proof that all parties saw the document.

A dynamic watermark puts the viewer’s email address and the time across the page. It works on pdf, docx, xlsx, ppt, md and common images, and with video Disable download switches on automatically. It discourages screenshots, but also makes reading harder.

What the viewer does not show

With downloads off, a party can only open what Tresorit’s viewer displays: doc, docx, pdf, txt, md, xls, xlsx, ppt, pptx, jpg, jpeg, png, bmp and mp4. A CSV is not among them, while an export from an e-discovery platform or a log file is often exactly a CSV.

Convert such files beforehand: to xlsx for tables, to pdf for documents. Leave the original next to it, so you can account for the conversion. Then test whether everything opens, in a browser window where you are not signed in. Otherwise you test your own access instead of the parties’.

Organising the folder

Make one subfolder per step in the assignment, with the date in the name. The preliminary report stays next to the final one, so everyone sees what was available when. Do not delete anything while the assignment runs: a document that disappears from a folder with access logs has to be explained afterwards.

Logs and adversarial process

At the first meeting, agree that the judge and the parties can request the logs, and share the answer with all parties each time. The logs contain IP addresses and times of identifiable persons. Giving them to one party is one-sided contact, and article 5 of the code says you must avoid that.

How long the folder stays shared

If the judgment says nothing about it, choose a term yourself, write it down and state that extension is possible with the judge’s agreement. Otherwise the folder stays open until somebody thinks of it.

In the report

  • which settings were on, by name;
  • from when to when the folder was shared;
  • which files were converted and to which format, noting that the originals are next to them;
  • the access logs as an annex.

Sources