How to check cross-customer data access at handover
Ask to see the same private file as its owner and as a customer of a different organization. Test the direct download URL separately from the document screen. Hiding the download button does not decide who can retrieve the file.
What to prepare
Use two fictional customer organizations and mark B’s document “Demo B”. Before the demonstration, agree whether a public link, invitation or temporary bearer link is an intended sharing mechanism.
Verification procedure
Keep the file fixed during the demonstration
Have B open and download the file. In a separate browser profile, sign in as A and revisit the saved document and download URLs. Use fixtures rather than real customer records.
Write a decision the contractor can retest
If A receives Demo B, return that scenario for a fix and identify the route and build. If B cannot open it either, record an incomplete demonstration. List exports separately if nobody tested them.
A handover note for one private file
B → B’s download: opens, “Demo B” visible
A → B’s download: denied, “Demo B” absent
B → B’s document: still opens after the fix
Build: ____ Retest owner: ____Decision and limitations
Accept the isolation item when the agreed denial and the legitimate use case both reproduce on the release candidate. Keep a dated copy of the result with the handover.
What remains unverified
A signed URL may intentionally grant access to its holder. Compare issuance, expiry and sharing with your requirements before calling a successful download a leak.