How secure are attachments uploaded to Airtable?

[Becky_Morris]

Can someone tell me whether attachments in Airtable/uploaded to an Airtable form are given a URL that allows anyone with the link to access the attachment without any sort of authentication please? I couldn’t find anything about this in the official documentation, but threads like this one say that this is how things work: Attachment URLs are public? I’m asking because I’ve been asked to upload an attachment containing tax information to an Airtable form and obviously I have concerns about this if Airtable will generate a URL that allows access to anyone who has the link. Thanks in advance for your help!

[JackM]

Attachments URL are not protected, the URLs can be accessed by anyone who has the link. You can test this by uploading a test attachment, opening it, copying the URL, and pasting that URL into a signed-out (or incognito) browser. If the URL loads the attachment it can be loaded by anyone.

I voiced concern to support, but Airtable maintains that this is secure because the odds of someone guessing your URL are near zero. Of course, I do not agree this is secure enough, so my business doesn’t use the attachment feature. We use the URL field type and drop in google-drive links, which are protected behind google account authentication as a work-around

[ScottWorld]

Welcome to the community, @Becky_Morris!

Airtable is a relatively low-security platform. As @JackM said, there is no security with attachments in Airtable. This is not a secure feature.

All attachment URLs are accessible by the public, and the attachment is STILL ACCESSIBLE at that URL even if you COMPLETELY DELETE the attachment from your Airtable base altogether.

That’s right — even if you DELETE the attachment from Airtable altogether, the attachment is still accessible at that URL.

So, you should use something like Google Drive or Dropbox or box.com to handle your attachments securely. Do not depend on Airtable for this.

[Becky_Morris]

Thanks @JackM and @ScottWorld! That’s very good to know! I’ll pass it on to the organization who was asking me to upload tax info as an attachment to Airtable.