Search engines and private messages?

Support
2

I’m certainly not the most qualified person here on this topic, but let me take a stab at it…

  1. Yes, message contents is only viewable by added users and admins. For true end-to-end encryption, you could further add this plugin.

  2. No…they only crawl what they have access to (and that doesn’t include private messages).

  3. The attachments themselves will be private unless someone finds or distributes the direct link. You may want to consider implementation of this to help lock it down further, though. That plugin will help prevent those attachments from going farther than intended by locking down those links to logged-in users, further ensuring that the files don’t go further than intended.

On a separate note, I would suggest that you take a hard look at what you consider “sensitive business info,” as you may have other legal obligations you need to consider. If you are storing sensitive PII (personal identifiable information), you may want to talk to your HR team and/or legal team to ensure that you’re handling that information appropriately. Depending on your organization, you might have to meet different requirements like HIPAA (for healthcare entities or entities incorporating certain types of services), FERPA (for educational institutions), GDPR (for certain entities with employees in the EU) PCI (for certain institutions processing financial transactions), or any number of other local laws. If you’re just talking about business practices and the like in your PMs, you should be fine. But if you’re talking sensitive personnel records…you’ll want to take a hard look at how you’re planning on processing those records and make sure storing them on a platform like Discourse doesn’t increase your liability. In those cases, you may want to outsource some of those functions to a service that is built for it and can give you something like a BAA, if needed.

“Sensitive” means a lot of different things to different people. I would just encourage you to make sure you know what your legal liability looks like before wading in too far.

5 Likes