Managing SafeBoxes in XM SendSecure Web or Mobile App

Administrator -

This article provides all information to access and manage your SafeBoxes using the XM SendSecure Web or Mobile App.


This article assumes that you have an XM SendSecure account, with either an access to the XM SendSecure Web Application (in XM SendSecure portal) or the XM SendSecure Mobile App installed on your mobile device.

If you need to install the Mobile App, see: XM SendSecure Mobile App.

Note: All screenshots shown here are from the XM SendSecure Web Application. If you are using the XM SendSecure Mobile App, the screens will be slightly different. However, the principle is the same on both apps.

Accessing the SafeBox List

To access the SafeBox list:
  • If you are using the Web Application, on the Web Portal and access your XM SendSecure home page.
  • If you are using the Mobile App, simply open it (as the main screen is the SafeBox list).
Note: To create a new SafeBox from there, see Sending Files Securely using XM SendSecure Web or Mobile App.

The SafeBox list allows you to browse through the SafeBoxes in which you are (currently) and were (in the past) intended to participate – except when you are a Guest.

SafeBox Indicators

The SafeBox subject is the Subject that was entered when composing the very first message at SafeBox creation. As it cannot be changed afterwards and because it is displayed here in the list for identification purposes, it is a best practice to enter relevant subjects for the different SafeBoxes you create.

The date/time shown at the right is the latest contribution time – i.e. the last time a participant (including you) replied or added some content to the SafeBox.

Several other visual indicators are intended to help you to quickly get basic/summarized information about each SafeBox:
  • Content and participants (examples)
    The SafeBox includes some content that you did not read/retrieve yet or that you marked as unread (in this example, 2 elements).
    (+3) The SafeBox has other participants in addition to yourself and the participant displayed at the left of this indicator (in this example, a total of 5 participants). The complete list is available in the SafeBox header.
  • SafeBox status
    The SafeBox is open: all active participants can access it and may be able to contribute (according to the SafeBox Security Profile).
    The SafeBox is closed: participants (including the Owner) can no longer contribute, but you may still be able to access the SafeBox content, depending on your role and on the Security Profile.
    The SafeBox content was permanently deleted, but you may still have access to the Activity Details/Audit Record depending on your role.
  • Other indicators
    You are the Owner of the SafeBox.
    You are a Privileged Participant in the SafeBox.
    The SafeBox was created by a third-party via a Secure Link.
    The SafeBox is currently unfollowed by you.

Accessing a SafeBox

To access a SafeBox, simply select it in your SafeBox list.

Note: If you are prompted to provide a decryption key, see Accessing a SafeBox when Prompted for Decryption Key.

SafeBox Header

The SafeBox header contains basic info on the SafeBox and its current status, with more or less info displayed depending on your role in the SafeBox.
Note: If you are the Owner or a Privileged Participant in the SafeBox, the participant list may show you visual indicators to inform you when participants are potentially unable to access the SafeBox (e.g. revoked access or delivery failure). To take action in such cases, see Managing SafeBox Participants.

SafeBox Content

The SafeBox content is displayed immediately below the header – as long as it is kept available to participants (depending on the SafeBox current status, on the Security Profile and on your role). It is presented in a form of a discussion between you and the other participants:
  • Each participant contribution is represented by a message box with detailed authoring information.
  • Each box may include a message and/or attached files.
  • Message boxes are always listed in a top-down chronological way (from the oldest to the latest).
  • Your own contributions are always displayed on the right side.
  • Any contributions appearing on the left side are always from other participants.

SafeBox Actions

All actions that you can perform on the SafeBox are selectable from the menu located at the top-right of the SafeBox header. In the Web Application, they are also selectable from the top menu bar.
Note: Available actions vary depending on the SafeBox current status, Security Profile and your role in the SafeBox. Also, their availability and the way they are represented in the Mobile App is a bit different from the Web Application. In this article, they are all explicitly presented with their names (i.e. instead of icons).

Taking Basic Actions on a SafeBox

Retrieving the SafeBox Content

Once in the SafeBox, you can retrieve all content (messages and files) that the other participants may have added (including your own content, if needed), at least as long as the SafeBox is open to contribution.
  • To download files, simply click on each desired file icon – or select the Download All option (when available) from the menu at the top right of the message frame where the files are located.
  • You can mark a message as read/unread according to your personal management needs using the message envelope icon – or even the whole SafeBox, using the Mark as Read/Mark as Unread options in the SafeBox menu.
Note: You may still be able to access the content after the SafeBox is closed (i.e. when the contribution period is over) depending on the Security Options and on your role in the SafeBox. Also, once the SafeBox status is "Deleted", the content is no longer retrievable (actually deleted), even by the Owner.

Replying/Adding Content

Replying to other participants or adding a supplementary contribution to a SafeBox actually represent the same action and can be achieved through the same functionality.
Note: You may not be allowed to reply depending on the Security Options and on your role in the SafeBox. Also, once the SafeBox is closed (i.e. the contribution period is over), this functionality is no longer available, even to the Owner.
To reply/add content to the SafeBox:
  1. Click Reply among the available actions – or directly at the bottom of the SafeBox page.
    Note: The action is Reply All if more than two participants appear in the list of the SafeBox header.
  2. Type a message and/or upload files to be added as attachments.
    Note: If you are the Owner or a Privileged Participant while the other participants don't see each other (According to the Security Profile), ensure to write a message that will not introduce confusion in the discussion – as all participants will receive it.
  3. Click Send.
    Note: Depending on the Security Profile, you may need to accept a statement of consent before adding content for the first time to the SafeBox. If you are the Owner (in the same context), you accepted the same statement de facto by creating the SafeBox.
All participants listed in the SafeBox header will be notified that you added some new content to this SafeBox (with a link to access it). On your side, you should now see the new content displayed in the SafeBox.
Note: If the SafeBox has an Alias (depending on the Security Profile), all replies posted by the Owner and the Privileged Participants will be seen by the other participants as coming from a single entity, under this Alias. However, the Owner and the Privileged Participants will always see each other under their respective identities.

Unfollowing/Following a SafeBox

When you become a participant in a SafeBox (including when you are its Owner), you are implicitly expected to follow its activity. However, if you need to take a step back, you can still hide the SafeBox from your current view and mute all notifications that you would basically receive about it.

To achieve this, select the SafeBox in the list and use the Unfollow option from the menu.

As a result, assuming that your current SafeBox list filters the unfollowed SafeBoxes (as per application default), you should no longer see the affected SafeBox in it. Also, you should no longer receive notifications about this SafeBox (i.e. replies, downloads, close...) – except on events that require your action if you are the Owner or a Privileged Participant (i.e. non-delivery report or self-revoked participant due to multiple login failures).

That said, as long as the SafeBox content is kept available to participants (depending on the SafeBox current status, on the Security Profile and on your role), you can still access it by selecting the Unfollowed criteria in the filtering options of the list.

Once in the unfollowed SafeBox, you can still contribute to it as long as it is open. You can also decide to get back on track for this SafeBox by using the Follow option from the menu.

Finding a SafeBox

Ordering & Filtering

SafeBoxes are always ordered by latest contribution time, and by default, the list displays all the SafeBoxes that you are following (unless you changed your personal XM SendSecure Options).

To filter your SafeBox list, select the filter tag (by default: Followed) at the top right of the list.

From there, you can use multiple filtering options regrouped by category:
  • Follow-up (Followed/Unfollowed)
  • Reading (Unread)
  • Status (Open/Closed/Deleted)
  • Role (Owner/Participant)
  • Source (Secure Link)

When your selection is done among these categories, click Apply.

Note: Selecting Default Filter at the bottom right resets the whole selection to the default filter that is set up in your personal XM SendSecure Options.

Searching for Text (by Word or Phrase)

The Search field can be used to search any text among all your SafeBoxes (excluding attachment contents).
Note: The text search functionality is designed to search either for a single word or for an entire phrase (i.e. a continuous sequence of words). It will not separately search for each word of the phrase entered in the field.

A text search may return results on SafeBox subjects, SafeBox messages (except for SafeBoxes having message encryption enabled), and also SafeBox IDs, participant names and attachment file names. It will however never return results on the text contained in any attached files, because the files are always encrypted.

Text search results may still be returned on SafeBoxes whose content has been already deleted – according to the information found in the SafeBox Activity Details.

Searching for a File (by Fingerprint)

If you have a local copy of a file that was transmitted (to you or from you) through a SafeBox and you need to have certainty or proof that your local copy is strictly identical to the one that was actually transmitted (for example in a litigation case), you can search for it based on its fingerprint.
Note: Any file can be represented through a unique fingerprint, which enables to unambiguously distinguish it from any other file. However, as the fingerprint (here, SHA-256 algorithm) does not appear among the file properties, it must be computed to be known. This is what this option makes for you on your local file before searching the resulting fingerprint among your SafeBox attachments.
Restriction: This option only supports file sizes up to 100 MB in the Web Application, and is not available in the Mobile App. As a workaround, you can still use an external tool to compute the SHA-256 of the file on your side, in order to manually search the resulting string using the regular text search option.

  1. Access the advanced search options by selecting the down arrow at the right of the search field:
  2. Select the Search SafeBoxes that include the following file option.
    Note: The text and file search options are exclusive (i.e. you can either search for a text phrase or for a file).
  3. Click Choose File to select your local copy of the file that you are searching for and then click Search.
    Note: The local file is not uploaded during this operation. Only its fingerprint is retrieved for being searched.

File fingerprint search results may still be returned on SafeBoxes whose content has been already deleted – according to the fingerprint information found in the SafeBox Activity Details.

Tip: The same functionality is offered to scope the search within a specific SafeBox instead of the whole SafeBox list. To achieve this, access the SafeBox and select Search File in the menu. This search tool behaves the same as the one of the SafeBox list described above.

Monitoring/Auditing SafeBox Activity

All the activity that occurs in the SafeBox is systematically recorded from the very moment the SafeBox is created.
Restriction: You can access to SafeBox activity information only if you are the Owner or a Privileged Participant of the SafeBox.
To get SafeBox activity information:
  • Basically, you can deploy the participant list in the SafeBox header to have a basic summary of the content retrieval status for each participant.
  • If you need to further investigate, you can access the SafeBox Activity Details (sub-page of the SafeBox).
  • Finally, once the SafeBox is closed, a SafeBox Audit Record is made available to you.

Activity Details

The Activity Details page represents a snapshot of the current SafeBox content and status by the time you look at it. To display it, simply select Activity Details in the SafeBox menu.

The content of the Activity Details changes/grows each time an action is taken by any participant (including the Owner) and when specific system events occur. It includes:
  • The SafeBox detailed properties (ID, time info, Security Profile...).
  • Participant information including summarized activity status for each.
  • All visible (non-encrypted) details of the contributions/exchanges.
  • A detailed status of downloads per participant.
  • The complete and detailed history of all participant activity and system events.
Note: The Activity Details page can still be displayed after the SafeBox is closed and even beyond the SafeBox content deletion. As such, it also contains information about post-close activity (accesses and downloads) that may occur before the content is deleted.

Audit Record

The Audit Record is a Signed PDF intended to serve as a non-repudiable proof of all exchanges that occurred in the SafeBox from its creation until the time it was closed (i.e. the SafeBox contribution period). Its content is organized the same way as in the Activity Details.

The Audit Record is automatically sent by email to the Owner and all Privileged Participants (if any) once the SafeBox is closed (actually attached to the "closed SafeBox" email notification). It can also be downloaded from the SafeBox by selecting Audit Record in the SafeBox menu.
Note: The Audit Record remains available beyond the SafeBox content deletion. However, as it was created at the time the SafeBox is closed, it does not contain information about post-close activity that may occur before the content is deleted, contrarily to the Activity Details page.

Managing SafeBox Participants

To manage the SafeBox participants, select Manage Participants within the SafeBox action menu.
Restriction: You can manage participants only if you are the Owner or a Privileged Participants of the SafeBox.

Adding New Participants

Additional participants can be invited to a SafeBox that is already created, as long as the SafeBox is not closed. To achieve this, simply use the Add Participants section, which works exactly like in a context of SafeBox creation (including favorites): see Sending Files Securely using XM SendSecure Web or Mobile App.
Note: The participants are added only when you click Apply; they will then receive (typically by email) an invitation to access the SafeBox.

Re-sending Participant Invitation

You can manually re-send to any existing participant the notification that was initially sent at SafeBox creation (either as a reminder or when the participant did not get it or lost it).

To achieve this, simply use the icon at the right of the participant that you need to notify again.
Attention: The notification is sent as soon as you select the icon (contrarily to the common behavior of the other participant management options).

Revoking/Restoring Participant Access

For traceability purposes, existing participants cannot be removed from the SafeBox. Instead, you have the option to revoke the SafeBox access of a participant. Participants whose access was revoked can no longer access the SafeBox content and no longer receive notifications from the SafeBox.
Note: The Owner's access can never be revoked (contrarily to Privileged Participants).

Conversely, when a participant access is revoked (either manually by you, or automatically after multiple unsuccessful authentication attempts by the participant), you have the option to manually restore it.

Under the Current Participants section:
  • In the Web Application:
    • To revoke the SafeBox access of the participant, use the icon.
    • To restore the SafeBox access of the participant, use the icon.
  • In the Mobile App, simply swipe the participant to the left, either to revoke or restore the SafeBox access of the participant.

In all cases, do not forget to click Apply to ensure that the participant access will be modified.

Modifying Participant Info

You can modify the contact information of Current Participants, for example to adjust or add a phone number intended to be used for two factor authentication purposes. Note that this will have no effect on your Favorites.

To achieve this:
  • In the Web Application, use the icon at the right of the participant.
  • In the Mobile App, simply tap on the participant.
Do not forget to select Apply to save the information in the SafeBox after modifying the participant info.
Note: By design, the participant email address cannot be modified. If you actually need to modify it, you will have to revoke access for the affected participant and add a new participant with the correct email address.

Modifying Participant Role

You can promote as Privileged Participant any XM SendSecure user from your Enterprise Account. By doing so, you allow this person to benefit from the same administrative role as you (the Owner) on the SafeBox. You can also remove privileges from a participant that was already promoted.

To achieve this, toggle the or icon (respectively not privileged/privileged) at the left of the participant.

This applies to both sections Current Participants and Add Participants. In all cases, do not forget to click Apply in the end.

Controlling the SafeBox Life Cycle

Restriction: You can control the SafeBox life cycle only if you are the Owner or a Privileged Participants of the SafeBox. That said, some of the options described below may not be available depending on the Security Profile.

Extending the SafeBox Duration

If you need to provide more time to allow you and the other participants to contribute to a SafeBox, select Extend Duration in the SafeBox menu. You will be prompted to specify the amount of time to add before the SafeBox is intended to automatically close by expiration.
Note: Depending on the Security Profile, the SafeBox duration may also auto-extend when a participant replies while the SafeBox is about to close (according to its schedule).

Closing a SafeBox

A SafeBox always has an expiration delay after which it is closed. Depending on the Security Profile, it may even automatically close after all participants retrieved the intended content.

However, if you assume that the secure exchange is done, you can manually close the SafeBox without waiting. Simply click Close Now in the SafeBox menu.
Attention: This action cannot be undone.

When a SafeBox is closed, all participants (including you) can no longer contribute to it. However, you may still have access to its content, depending on the Security Profile. If no retention period was set, the content is automatically deleted once the SafeBox is closed.

Deleting the SafeBox Content

If you need to manually delete the content of a closed SafeBox during the retention period, simply click Delete Now in the SafeBox menu.
Attention: This action cannot be undone.

When a SafeBox has its content deleted, it remains in your SafeBox list and the only information you still have access to is the one found in its Activity Details/Audit Record.

Have more questions? Submit a request


Powered by Zendesk