# Secure sharing, SaaS and third-party data flows

Do not confuse an encrypted connection with permission to share. Review class, purpose, recipients and external-copy accountability in the local data passport.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Recipient and purpose boundary

Harbor needs to send a contract to a specific partner team. Creating a link does not establish the recipient’s identity or authority. Specify class, necessary fields, purpose, recipients and duration together. Public links and identity-scoped sharing are different access models. Encryption alone does not resolve disclosure to the wrong recipient. Record where the shared copy will remain and who owns it. This exercise creates no actual link and sends no document; it compares declared metadata decisions for fictional records.

## Read the local sharing profile

This teaching profile requires purpose and review references for every share. Public records may reach different destinations when other conditions hold. Internal records stay internal; restricted records stay internal and require confirmed encryption. Confidential records may reach approved partners with declared encryption, but not public destinations. These are fictional Harbor rules, not a universal DLP standard. Reference presence verifies no approval, and an encrypted flag verifies no cryptography. The local tool does not inspect content and cannot discover that a declared class is wrong.

## SaaS chain and exit planning

A SaaS contract does not alone establish subprocessors, location, support access, backups and exit scope. Authorized legal, procurement and security teams assess real obligations together. This package makes no cross-border legal or automatic compliance decision; the existing regulatory guides cover that context separately. Harbor records service/data ownership, external copies and required exit evidence. A provider’s general certification does not establish business approval of this particular flow or every deletion outcome. Review scope and responsibilities rather than substituting a contract label for evidence.

## Revoking a link does not recall every copy

Removing a link may not erase downloads, screenshots or derivatives in another system. Authorized teams track access, sessions, copies and contractual return requirements separately. Harbor places the applied target operation beside its verified outcome. If the actual result cannot be confirmed, record residual risk and follow-up ownership. The local model evaluates only the fictional sharing rules; it contacts no recipient and recalls no data. Closing a share should not rely on a link counter while ignoring copies and unresolved effects outside that access boundary.

## Working sequence

1. Record classification and business purpose.
2. Limit recipient, destination and required fields.
3. Compare sharing decisions in two synthetic files.
4. Review SaaS copies and exit ownership.
5. Distinguish revoked access from remaining copies.

## 1. The link is ready

A link does not establish correct recipients or necessary scope. Do not treat sharing as approved without limiting recipient, purpose, duration and data fields.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.linkCreated === true
```

### Corrected implementation
```js
s => s.linkCreated === true &&
  s.recipientVerified === true &&
  s.scopeLimited === true &&
  s.expiryDefined === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "linkCreated": true,
        "recipientVerified": true,
        "scopeLimited": true,
        "expiryDefined": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-recipientVerified",
      "input": {
        "linkCreated": true,
        "recipientVerified": false,
        "scopeLimited": true,
        "expiryDefined": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-scopeLimited",
      "input": {
        "linkCreated": true,
        "recipientVerified": true,
        "scopeLimited": false,
        "expiryDefined": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "linkCreated": true,
        "recipientVerified": true,
        "scopeLimited": true,
        "expiryDefined": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-recipientVerified",
      "input": {
        "linkCreated": true,
        "recipientVerified": false,
        "scopeLimited": true,
        "expiryDefined": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-scopeLimited",
      "input": {
        "linkCreated": true,
        "recipientVerified": true,
        "scopeLimited": false,
        "expiryDefined": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. The contract is signed

A signed contract is not data-chain or exit evidence. Map subprocessors, location and copy responsibilities separately; actual legal decisions belong to authorized processes.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.contractSigned === true
```

### Corrected implementation
```js
s => s.contractSigned === true &&
  s.subprocessorsMapped === true &&
  s.locationReviewed === true &&
  s.exitPlanned === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": true,
        "locationReviewed": true,
        "exitPlanned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-subprocessorsMapped",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": false,
        "locationReviewed": true,
        "exitPlanned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-exitPlanned",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": true,
        "locationReviewed": true,
        "exitPlanned": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": true,
        "locationReviewed": true,
        "exitPlanned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-subprocessorsMapped",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": false,
        "locationReviewed": true,
        "exitPlanned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-exitPlanned",
      "input": {
        "contractSigned": true,
        "subprocessorsMapped": true,
        "locationReviewed": true,
        "exitPlanned": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. The link was removed

Removing a link does not erase downloads. Without copy scope, session context and verified target outcomes, total termination of access and disclosure remains unestablished.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.linkRemoved === true
```

### Corrected implementation
```js
s => s.linkRemoved === true &&
  s.copiesReviewed === true &&
  s.sessionsConsidered === true &&
  s.outcomeVerified === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": true,
        "sessionsConsidered": true,
        "outcomeVerified": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-copiesReviewed",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": false,
        "sessionsConsidered": true,
        "outcomeVerified": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-outcomeVerified",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": true,
        "sessionsConsidered": true,
        "outcomeVerified": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": true,
        "sessionsConsidered": true,
        "outcomeVerified": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-copiesReviewed",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": false,
        "sessionsConsidered": true,
        "outcomeVerified": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-outcomeVerified",
      "input": {
        "linkRemoved": true,
        "copiesReviewed": true,
        "sessionsConsidered": true,
        "outcomeVerified": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Class/purpose/recipient/destination and time-bound sharing passport.
- External-copy, subprocessor, exit and validation record.

## References

- [Microsoft Purview · Data loss prevention overview](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
- [NIST SP 800-209 · Storage infrastructure security · October 2020](https://csrc.nist.gov/pubs/sp/800/209/final)