How client links are protected

Each client has one private link, and the link is what lets them in. They don't need an account, so there's no password for them to forget or reuse on another site. For sensitive documents, you can also ask for a 6-digit PIN that you give your client yourself.

The link itself

• The client link opens a page listing that client's open requests, and the ones completed in the last 90 days. Your client sees the documents asked for, what they've uploaded and their own notes, never other clients.
• A request sent with its own link isn't on that page. Its link opens that one request only.
• Each link ends in a random 48-character code, made fresh for each client and each request. It can't be worked out from the client's name, the request or any other link.
• GarnerDocs stores only a hash of that code, plus an encrypted copy so your team can copy the link again. The link can't be read straight out of the database.

An optional PIN

• Select Protect with a PIN in the client's Client link card. Your client then enters a 6-digit PIN before they see any request on the link, including from a request's own link.
• A request sent with its own link can have its own PIN instead. Owners and admins can make a PIN the default in Settings → Workspace.
• GarnerDocs makes the PIN, so it's never a weak one. You give it to your client by phone or text message. It's never in an email, so someone who reads the email still can't open the requests.
• After 5 wrong PINs, the next wrong one locks the link for 15 minutes for everyone, whatever device or network they use. Your team is notified.

Protect a request with a PIN

Guessing is blocked

• Each link can only be opened a limited number of times a minute from the same connection.
• A connection that tries 10 links that don't exist within a minute is refused for the rest of that minute, so links can't be found by trying lots of them.

Kept out of sight

• Upload pages tell search engines not to list them.
• When your client follows a link away from the upload page, the upload page's address isn't passed on to the next site.

When a link stops working

A client link closes, and shows "This link isn't valid anymore", when:

• You generate a new client link. The old one stops working straight away. Reset a client link
• You archive the client.
• The workspace is deleted.

A request leaves the client's page, and its own link closes, when:

• The request is cancelled.
• A completed request's files are deleted, by the retention period or with Delete files now.
• A completed request reaches 90 days after completion, even if your retention period keeps the files longer.

A request's own link also closes when you generate a new link for that request. A draft's link doesn't work until the request is sent. If a link once worked, the page names your firm, so your client knows whom to ask for a new one.

If a link goes to the wrong person

Generate a new client link straight away, then copy it and send it to your client. The client's activity records that the link was replaced. Copy or share the client link

Good to know

• Without a PIN, anyone who has the client link can open every request on it, just as anyone with a key can open a door. Send it only to your client, and reset it if it's forwarded. Generating a new link keeps the PIN.
• If someone else at your client handles one request, send that request with its own link, so they don't see the others.
• More about how files are stored and who can see them: Security.