Public Link on the Pricing Model Database
Helio Health is a 300-person telehealth company. Notion holds product specs, finance models, and clinical operations. There are 45 guests, including contractors and two hospital partners. Public page sharing is enabled because marketing shares help-center drafts. Last Tuesday a finance analyst used Share to web on the Q3 Pricing Model page to send a link to an external consultant. The page contains a database with 1,200 customer account names, ARR, and renewal dates. The consultant forwarded the link to a personal email; IT found it in a browser sync alert. The analyst says she thought Share to web only worked for people with the link, not search engines. The page had no password. The workspace uses SAML SSO and SCIM but has no data classification policy. Executives want to keep external collaboration but need evidence for SOC 2 and an upcoming ISO 27001 audit.
1. What containment steps and evidence should Helio take first?
Read the worked answer
Turn off Share to web for the page immediately, or remove the public link and replace it with a narrowly scoped guest share if the consultant still needs access. Preserve the page and its history before making further changes. Record the public link, the time it was created, the analyst, the consultant, and the content exposed.
Use page history and the audit log, where available, to reconstruct permission changes and access. Notion's audit log is not a full packet capture, so do not promise the ability to identify every viewer; state what evidence exists. Notify security, legal, and privacy according to the incident process. Assess whether the data includes protected health information or personal data that triggers breach notification. Because the link was forwarded, assume uncontrolled distribution until proven otherwise.
Do not simply delete the page. Deletion can destroy evidence and may conflict with retention obligations. The containment priority is to stop further public access, preserve evidence, and escalate.
2. Which workspace controls should reduce the chance of recurrence?
Read the worked answer
Disable public page sharing workspace-wide, or restrict it to a small owner group with an approval step. If marketing needs public pages, create a dedicated public-content area and a review workflow rather than allowing every member to publish any page. Turn off search-engine indexing for public pages unless marketing explicitly needs it.
Introduce data classification: Public, Internal, Confidential, Restricted. Finance and clinical databases should live in private teamspaces with least-privilege membership. Use page-level restrictions such as disabling copy and export for sensitive pages where the plan supports it. Keep guest access on trusted domains and review guests quarterly. SAML SSO and SCIM already help with identity lifecycle; add a guest lifecycle process because guests are not covered by SCIM.
Finally, make the control auditable: document who can publish publicly, keep approval records, and review audit logs. For SOC 2 and ISO 27001, the evidence is the policy, the configuration, the approval trail, and the review record, not just the disabled toggle.
3. How should Helio reconcile marketing's need for public help-center drafts with the new restrictions?
Read the worked answer
Separate public publishing from the general workspace. Marketing should use a dedicated Public Marketing teamspace or a separate public-content workspace that contains only approved material. Drafts that contain customer data, internal commentary, or unreleased pricing stay in the internal teamspace.
Create a publishing checklist and a named approver. Public pages should be copied from a controlled template, stripped of internal comments and database views, and reviewed before Share to web is enabled. If the workspace restricts public sharing to owners, marketing can route requests through the owner group rather than granting publish rights to everyone.
The judgement is to preserve the business need without treating all content as equally publishable. A blanket ban would push marketing to shadow tools; a blanket allow recreates the incident. A narrow, auditable public channel with classification and approval is the middle path.