Skip to main content

​
Overview

Data sharing policies let security officers enforce organisation-wide rules about how encrypted files leave a room. Policies are set from Security → Policies → Data Sharing.
The Security → Policies hub contains multiple policy types beyond data sharing: Storage, Encryption, DLP, Org Unit Roster, Clearance Matrix, Access Reviews, and Alert Policies. This page covers the Data Sharing tab only. See Security Alerts for alert policy configuration and DLP for content-scanning policies.
Enclave enforces a most-restrictive-wins model across three policy tiers. Each tier can only tighten restrictions — it can never loosen a block applied by an outer tier.

​
Share targets

When a user shares a file or folder, they choose a direction and a target type:
Org Unit sharing is always internal. There is no concept of sharing to an external org unit.

​
Tier 1 — Tenant policy

The tenant policy is the master on/off switch for all sharing directions. Navigate to Security → Policies → Data Sharing and toggle:
  • Allow internal sharing — enables sharing to internal targets (Tenant, Org Unit, User)
  • Allow external sharing — enables sharing to external targets
If internal sharing is off, no internal sharing is possible regardless of classification policy.

​
Tier 2 — Classification policy

For each classification level (C1–C4), you can configure per-target-type controls. These apply on top of the tenant policy — they can only restrict further. Classification levels cascade independently — you can allow C1 files to be shared freely while blocking C3 files from being shared to external users.

​
Tier 3 — Per-type rules

When Block Org Unit is off at tier 2 (org unit sharing is allowed), you can add additional restrictions scoped to specific Org Unit type labels (e.g. Domain, Team, Division). Per-type rules can only add restrictions — they cannot loosen a block from tier 1 or tier 2.

​
Example

Policy for C3 (Confidential):
  • Block Org Unit: off (org unit sharing allowed)
  • Per-type rule for “Domain”: Block = on
  • Per-type rule for “Team”: Require expiry = on, Require PIN = on
Result: C3 files cannot be shared to Domain units at all. Sharing to Team units is allowed but requires both an expiry date and a PIN.

​
How type labels work

Type labels on Org Units are free-text (e.g. Domain, Department, Team, Squad). Per-type rules match on the label case-insensitively. You configure rules by typing or selecting the label in the policy editor.
Per-type rules only apply when the base Block Org Unit setting is off. If org unit sharing is blocked at tier 2, per-type rules are ignored — the block always wins.

​
Clearance-based share controls

On top of the three policy tiers, sharing is gated by clearance (see Clearance Levels) — a mandatory access control that policy tiers cannot override:
  • Sharer must be cleared. You cannot share a file whose classification exceeds your own clearance — you cannot share what you cannot read.
  • Internal recipient must be cleared. When sharing to a single internal user, that user’s clearance must meet the file’s classification, or the share is refused with a clear reason. Group targets (Org Unit / Tenant) can’t be checked per-member at share time, so clearance is enforced for each member at read time instead.
Creating an external (federated) invitation carries a clearance ceiling — the highest classification the guest may open. Granting a C3 (Confidential) or C4 (Restricted) ceiling is a high-sensitivity action and is held for administrator approval:
  1. The inviter chooses a clearance ceiling of C3 or C4 and supplies a mandatory justification.
  2. Instead of issuing the link immediately, Enclave opens an N-of-M approval workflow whose approvers are the room’s administrators. The inviter sees a “pending approval” state.
  3. Approvers review and decide from the normal Approvals queue. Once the threshold of approvals is met, the invitation is minted and emailed to the recipient automatically. If rejected or expired, no link is ever created.
Invitations with a C1/C2 ceiling are issued immediately, as before. The ceiling is also bounded from below by the room’s classification floor: a room classified Internal, Confidential, or Restricted requires a ceiling of at least C2, C3, or C4 respectively. Enclave pre-selects the floor in the invitation form and rejects anything lower — a guest who cannot open the room’s own files has no reason to be in the room.
The clearance ceiling also filters what the guest sees: files above the ceiling never appear in the external file list, and any download attempt above it is refused. External parties start at C1 (public only) unless granted more.

​
Security model

  • Cascade direction: Tenant → Classification → Per-type. Each level can only tighten.
  • Clearance is mandatory: the clearance checks above apply on top of policy and cannot be loosened by any tier.
  • Most restrictive wins across files: When sharing multiple files in one operation, the most restrictive policy among all the files applies to the entire batch.
  • PIN hashing: PINs are hashed with bcrypt at rest. Kvelden never stores or sees the raw PIN.
  • Expiry enforcement: Expired shares are automatically rejected at access time — the recipient cannot access the file after the expiry timestamp.
  • Audit trail: Every share creation and access attempt is written to the immutable audit log.

​
Configuring policies

  1. Navigate to Security → Policies → Data Sharing
  2. Use the matrix to see all four classification levels side-by-side
  3. Click a level to expand the editor
  4. Toggle blocking rules and security requirements
  5. To add per-type rules: with Block Org Unit off, scroll to the Org Unit type rules section, select or type a type label, and configure its restrictions
  6. Click Save policy
Changes take effect immediately for new share operations. Existing shares are not revoked.