Workspace security

@[quote=“Axelle_Dumont, post:1, topic:29382, full:true”]
Hi ! I’d like to better understand if people I did not share my workspace with have ways to find my boards and open it. I’d like to make sure the information I store in my boards is secure.

It’s a great question. Not sure you’ll like the answer.

Keep in mind that there’s a difference between bases (individual collections of data) and workspaces (which are collections of bases). I know that bases are not really secure. See this recent thread: Is it possible to KEEP SOMEONE OUT of an Airtable base?. The upshot there was that an Airtable base – like a secret – is probably pretty secure until you share it with one other person. After that, you don’t have much control over what happens. I’m hoping that Airtable will soon make it possible for creators and owners to disable the “share” button (which is the source of the problem).

As for workspaces, something similar is true, except now it applies to many bases, not just one. If you click the share button for a workspace, the sharing setup dialog says: “Adding a workspace collaborator will give them access to all bases within this workspace.” Seems pretty clear, no? And now, if you go back to the thread I linked to in the previous paragraph, you’ll see that anybody with whom you have shared the workspace has the ability to share the bases within that workspace with, well, pretty much anybody else.

.

NO security of any kind is 100% reliable. And you always need to carefully consider your “threat model”. One question to ask yourself is, how bad would it be if your data was shared outside of the circle of people you consider approved for access? There are lots of situations, even in business, where the owner of the data would of course like to keep it private but where a breach of privacy wouldn’t be catastrophic, usually because the data simply does not have much value to anybody else.

If you’re running that sort of business or working on that sort of project, Airtable can be a terrific tool.

William

As @WilliamPorterTech mentioned, if you only share a base with someone, that person won’t be able to access the other bases in your workspace.

However, once you share a base with someone, they are able to share that base with other people — without your permission. They are also allowed to duplicate that base — without your permission.

If you trust the people you work with, this would hopefully not be an issue. But it’s not really a great security model. It’s basically a “the door is wide open” security model.

It seems like you would have to upgrade to the Enterprise version of Airtable to get better security. Not sure what that costs. It’s probably prohibitively expensive, since they don’t list the pricing on their website.

Long story short: Airtable needs to improve their security.