💬 Join us to post & get advice from 50,000 HOA & Condo leaders.

Create Free Account →

⚡ Takes 30 seconds

Already a member? Log in

MikeB16 (Montana)
Posts: 17
Posted:
How does your board share information online? Do you use special encryption software or just sent it by regular e-mail? Are there any reasonably priced software packages?
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By MikeB16 on 05/17/2022 8:35 AM
How does your board share information online? Do you use special encryption software or just sent it by regular e-mail? Are there any reasonably priced software packages?

Mike, there's an robust set of survey responses dedicated to CIC document management that will help address your question. In brief, 72% of CICs use email as the most frequent way to collaborate on documents.

You can search "condo document management" on Bing for more information.

Regards,
Steve
KerryL1 (California)
Posts: 14,550
Posted:
Please clarify, Mike. Do you mean share information with fellow board members?

How does your Board receive information for board meetings? Online? Some kind of hard copy "board packet?"
SheliaH (Indiana)
Posts: 6,964
Posted:
If you're talking about sharing information with the board members, we used regular mail. The management report was pretty hefty, so that stuff was saved in a PDF.

If you're concerned about confidential information, you can usually assign password protection to the document and send the email separately, followed by the password. Better yet, if you have a community website, why not set up a separate portal for board members and upload all the information that way? The password could be the board member's account with the association and access would be deleted upon the board member stepping down or being voted off (or recalled) from the board. Talk to your webmaster to see if that can be done.

If you want to use email, you have more to think about than simply securing the messages. What you need is a formal policy that can address other issues, such as not forwarding correspondence between the board and association attorney to unauthorized people, saving emails permanently if they concern association business (these become the association's permanent records), requiring board members to have a dedicated email account for association business only or setting up one account that all board members to access, etc. Talk to your association attorney and master insurance company about setting up procedures that reduce risk

If it is not right do not do it; if it is not true do not say it. Marcus Aurelius
MikeB16 (Montana)
Posts: 17
Posted:
I guess my question was basically our secretary was sending information to me with secured winzip file. I can't open it. I am assuming I can if I pay $30 a year to get winzip with password. We have just taken back doing our books from a property management company.
AugustinD
Posts: 3,698
Posted:
Quote:
Posted By MikeB16 on 05/17/2022 11:25 AM
I guess my question was basically our secretary was sending information to me with secured winzip file. I can't open it. I am assuming I can if I pay $30 a year to get winzip with password. We have just taken back doing our books from a property management company.
-- Are you sure you are stuck with paying for a subscription? I see signs winzip may be downloadable for free.

-- If you must have winzip and must pay for it, ask that you be compensated the cost as a director expense. Every set of HOA/COA governing documents I have seen has such a provision. My personal rule is never to pay out of my own pocket for any volunteering I do. It's enough that I donate my labor, and I would resent paying anything for the "privilege" of being able to serve for many hours each year.
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By MikeB16 on 05/17/2022 11:25 AM
I guess my question was basically our secretary was sending information to me with secured winzip file. I can't open it. I am assuming I can if I pay $30 a year to get winzip with password. We have just taken back doing our books from a property management company.

Your CIC is running your own financials without the help of a third party?! For how many members, for what size budget and what type of community?
BillD16 (Texas)
Posts: 974
Posted:
Quote:
Posted By MikeB16 on 05/17/2022 11:25 AM
I guess my question was basically our secretarywas sending information to me with secured winzip file. I can't open it. I am assuming I can if I pay $30 a year to get winzip with
password. We have just taken back doing our books from a property management company.

Your operating system should provide some kind of free ZIP utility that should handle encryption/decryption. Try that before spending $30.

She’s sending you a ZIP file and a password, right?

BillD

HOA Board ex-President
Austin, Texas USA

“You can’t put too much water in a nuclear reactor”
MaxB4
Posts: 3,513
Posted:
I use regular email programs to send files and communicate. Large files are put onto a web portal and they can download at their leisure.
MikeB16 (Montana)
Posts: 17
Posted:
Yes. I just discovered I can get encrypted e-mail with my gmail that I seldom use.
MikeB16 (Montana)
Posts: 17
Posted:
There are 28 members of our HOA. I am President. We have a $50,000 budget.
MikeB16 (Montana)
Posts: 17
Posted:
Quote:
Posted By KerryL1 on 05/17/2022 10:26 AM
Please clarify, Mike. Do you mean share information with fellow board members?

How does your Board receive information for board meetings? Online? Some kind of hard copy "board packet?"

Usually just an agenda with information presented at the board meeting.
MikeB16 (Montana)
Posts: 17
Posted:
Are you sure you are stuck with paying for a subscription? I see signs winzip may be downloadable for free.

There is a short free trial period.

-- If you must have winzip and must pay for it, ask that you be compensated the cost as a director expense. Every set of HOA/COA governing documents I have seen has such a provision. My personal rule is never to pay out of my own pocket for any volunteering I do. It's enough that I donate my labor, and I would resent paying anything for the "privilege" of being able to serve for many hours each year.

That is a very good point.
MaxB4
Posts: 3,513
Posted:
Why is anyone using encrypted email, are we dealing with national security?
MikeB16 (Montana)
Posts: 17
Posted:
Quote:
Posted By MaxB4 on 05/17/2022 5:33 PM
Why is anyone using encrypted email, are we dealing with national security?

I guess that was part of my question. I don't understand enough about internet security though.
LoriM15 (Florida)
Posts: 1,009
Posted:
All of our information is sent out via an "eblast" to the emails of our homeowners. That includes notices of upcoming meetings and agendas. No encryption or login required.

Our monthly financials and minutes of the meetings are posted on our website which requires a homeowner login. My state has open records laws, so any homeowner can request to view almost any document except personnel and legal issues. When we do our annual budget we send out the whole budget information with actuals from the previous year. So there is really no private finanacial information.

I don't see why you can't just email the information to your homeowners.
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By LoriM15 on 05/18/2022 9:01 AM
All of our information is sent out via an "eblast" to the emails of our homeowners. That includes notices of upcoming meetings and agendas. No encryption or login required.

Our monthly financials and minutes of the meetings are posted on our website which requires a homeowner login. My state has open records laws, so any homeowner can request to view almost any document except personnel and legal issues. When we do our annual budget we send out the whole budget information with actuals from the previous year. So there is really no private finanacial information.

I don't see why you can't just email the information to your homeowners.

I love conversations where people start talking about their secure portals. There's nothing all that "secure" about an ecosystem where homeowners download information and/or where staff and managers email attached documents that end up "in the wild." Anyone can take that information and send it anywhere by email, through a link, on a thumb drive, etc. By the way, 99%+ of CIC regards aren't actually confidential. Consider that potential purchasers receive quite a lot of data as part of a resale certificate.

The concept of having "secure" portals to access non-confidential data is simply a way for quite a lot of companies to sell a product. Oh, the company that operates HOATalk is one of them -- NOT saying that some of these products aren't value-added, but the term "secure" is misused.

There *IS* something to be said about transmitting data by email that is likely accomplished more efficiently in another way (for example, sending a link to a system that requires authentication, so that all the documents live in one place that's not someone's inbox).

Regards,
Steve
LoriM15 (Florida)
Posts: 1,009
Posted:
Our treasurer, who otherwise does a phenomenal job, refuses to put any documents on dropbox or google drive or other shared space. He doesn't trust "the cloud". So if I need to see an updated financial or an invoice I have to ask him to send me a copy, which doesn't preclude me from sending it to whoever I want. I think it's more about control than trust.

Any sensitive information can still be password protected on a shared drive and you can set permission levels like "read only" on a shared drive. You are right, there are easier ways to share information than just emails.

The only way to guarantee privacy is to not have any electronic versions and control access to the hard copies. That's just not practical for most people in today's world.
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By LoriM15 on 05/18/2022 10:52 AM
Our treasurer, who otherwise does a phenomenal job, refuses to put any documents on dropbox or google drive or other shared space. He doesn't trust "the cloud". So if I need to see an updated financial or an invoice I have to ask him to send me a copy, which doesn't preclude me from sending it to whoever I want. I think it's more about control than trust.

Any sensitive information can still be password protected on a shared drive and you can set permission levels like "read only" on a shared drive. You are right, there are easier ways to share information than just emails.

The only way to guarantee privacy is to not have any electronic versions and control access to the hard copies. That's just not practical for most people in today's world.

Although there are probably no CICs that have taken things this far, there are methods to contain data by making it available to view online (and not download) in a user-authenticated environment. Google Drive has a feature to do exactly that and it works quite well. I believe SharePoint and OneDrive are adding that feature soon. Some other platforms also allow "document previews" and no downloads.

Thinking about any corporate environment, documents are typically stored within a secure network and not intended to leave. There are programs that monitor the use of portable drives, when emails are sent that leave the corporate intranet, etc. In short, there are many ways to contain data and honestly, I see no problem with these systems. I also see no problem with providing a bunch of links to data that anyone can access because it's no different than emailing someone an attachment or allowing them to download a file and then share it everywhere. This situation is perhaps most akin to surveillance vs. security.
MichaelH34 (North Carolina)
Posts: 179
Posted:
Quote:
Posted By SteveH35 on 05/18/2022 11:37 AM
Posted By LoriM15 on 05/18/2022 10:52 AM
This situation is perhaps most akin to surveillance vs. security.

In many situations surveillance is the best option for some types of security in the IT world. Source: IT guy for 40+ years.

In much the same way that cameras more often than not don't prevent crime, monitoring like has been described above, doesn't keep people from exfiltrating data. The best it does is allow you to find out who did what and call them to account.

The only way to keep the data where it belongs is to lock it down DOD-style which would be massive overkill for the situation described.

It really sounds like the treasurer is operating from a position of ignorance and fear. IMO the best course is to address the ignorance and hope that the fear resolves itself with more and accurate knowledge.

If the data *must* remain secure, the old adage "three can keep a secret if two are dead" comes to mind. That really shouldn't be the level of concern here.
BillD16 (Texas)
Posts: 974
Posted:
Quote:
Posted By MaxB4 on 05/17/2022 5:33 PM
Why is anyone using encrypted email, are we dealing with national security?

It does seem like overkill for these circumstances.

On the other hand, if it’s painless enough, it can’t hurt. And it’s a Good Thing on the general principle that It Ain’t Nobody’s Business: if you’ve got a group of people flinging documents around, possibly saving them off to random cloud locations, accidentally including the ex-spouse on the Bcc: line, etc, then it might help some people sleep a tad better knowing that the docs are encrypted.

BillD

HOA Board ex-President
Austin, Texas USA

“You can’t put too much water in a nuclear reactor”
BillD16 (Texas)
Posts: 974
Posted:
> there are methods to contain data by making it available to view online (and not download) in a user-authenticated environment.

How’s that hold up to, say, a camera taking pictures of the screen?

BillD

HOA Board ex-President
Austin, Texas USA

“You can’t put too much water in a nuclear reactor”
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By BillD16 on 05/18/2022 2:08 PM
> there are methods to contain data by making it available to view online (and not download) in a user-authenticated environment.

How’s that hold up to, say, a camera taking pictures of the screen?

BillD

...one can take pictures with modern devices in nearly *ANY* environment, except where cameras are prohibited, like on nuclear submarines and within the Hanford site. Limiting documents to online viewing is incredibly powerful and value-added (for folks who really care about making documents more "secure"), especially when those documents are multiple pages or tabs. We're not talking about state-level secrets. Again, there are dozens of companies (including the sponsor of this site) that make their money selling customers a "secure" portal, that offers little to no data security for documents that are easily downloaded or regularly disseminated as email attachments. That's all.
JohnT38 (South Carolina)
Posts: 1,631
Posted:
Quote:
Posted By SteveH35 on 05/18/2022 2:14 PM
Posted By BillD16 on 05/18/2022 2:08 PM
> there are methods to contain data by making it available to view online (and not download) in a user-authenticated environment.

How’s that hold up to, say, a camera taking pictures of the screen?

BillD

...one can take pictures with modern devices in nearly *ANY* environment, except where cameras are prohibited, like on nuclear submarines and within the Hanford site. Limiting documents to online viewing is incredibly powerful and value-added (for folks who really care about making documents more "secure"), especially when those documents are multiple pages or tabs. We're not talking about state-level secrets. Again, there are dozens of companies (including the sponsor of this site) that make their money selling customers a "secure" portal, that offers little to no data security for documents that are easily downloaded or regularly disseminated as email attachments. That's all.

We made an effort to store all Board related documents on our website under a section available to Board members. We organized by year in folders such as Quotes, Budgets, ARC requests, Landscape Requests, Violations, Reserve Study, etc. Although I realize most HOA's won't do this, having the information available is useful to the current Board and future Boards that can go back and see what was done. Sometimes looking back in history can be very helpful.

When I left the Board and explained where these documents were to the new Board I could tell they were problem thinking "who cares"? I hope I'm wrong.
MichaelT21 (Arkansas)
Posts: 501
Posted:
Quote:
Posted By JohnT38 on 05/18/2022 2:37 PM
Posted By SteveH35 on 05/18/2022 2:14 PM
Posted By BillD16 on 05/18/2022 2:08 PM
> there are methods to contain data by making it available to view online (and not download) in a user-authenticated environment.

How’s that hold up to, say, a camera taking pictures of the screen?

BillD

...one can take pictures with modern devices in nearly *ANY* environment, except where cameras are prohibited, like on nuclear submarines and within the Hanford site. Limiting documents to online viewing is incredibly powerful and value-added (for folks who really care about making documents more "secure"), especially when those documents are multiple pages or tabs. We're not talking about state-level secrets. Again, there are dozens of companies (including the sponsor of this site) that make their money selling customers a "secure" portal, that offers little to no data security for documents that are easily downloaded or regularly disseminated as email attachments. That's all.


We made an effort to store all Board related documents on our website under a section available to Board members. We organized by year in folders such as Quotes, Budgets, ARC requests, Landscape Requests, Violations, Reserve Study, etc. Although I realize most HOA's won't do this, having the information available is useful to the current Board and future Boards that can go back and see what was done. Sometimes looking back in history can be very helpful.

When I left the Board and explained where these documents were to the new Board I could tell they were problem thinking "who cares"? I hope I'm wrong.

I have an extremely detailed record keeping system on my computer (actually it's cloud storage via Microsoft 365 OneDrive) and it's great. Detailed. Comprehensive. I use it all the time to reference past stuff.

However, I am the only one that cares...
BillD16 (Texas)
Posts: 974
Posted:
> Limiting documents to online viewing is incredibly powerful and value-added

I realize that nobody here really cares about this, but this is so patently false and misleading that I can't help myself:

At best, this kind of system will guard against casual replication. Anyone who *really* wants to copy a document from this kind of system will copy it, whether it be via camera{1}, screen-grab, direct inspection of computer memory, or out-and-out memorization of the text ala _Fahrenheit 451_.

At worst, it's potentially hazardous to trust such a system to provide more security than it is capable of providing.

And it doesn't help that the most 'secure' form of this - involving hardware TC / TPM / etc = is just freakin' *creepy*.

I have used a system like this, and believe me: the first time you get an email that you can't copy or print, you don't think "what marvelous security!" You think: "the person who sent me this is a self-important pencildick".

BillD

{1} "You joined my company. Gained our trust. Gained my trust. Then stole my code on your James Bond wrist watch."

HOA Board ex-President
Austin, Texas USA

“You can’t put too much water in a nuclear reactor”
SteveH35 (Washington)
Posts: 339
Posted:
Quote:
Posted By BillD16 on 05/18/2022 6:07 PM
> Limiting documents to online viewing is incredibly powerful and value-added

I realize that nobody here really cares about this, but this is so patently false and misleading that I can't help myself:
At best, this kind of system will guard against casual replication.
{1} "You joined my company. Gained our trust. Gained my trust. Then stole my code on your James Bond wrist watch."

That's my point. CICs are not guarding state secrets. This thread asks "what level of data security is appropriate for CIC documents?" Casual protection is all that's necessary.
JohnT38 (South Carolina)
Posts: 1,631
Posted:
Quote:
Posted By SteveH35 on 05/18/2022 7:35 PM
Posted By BillD16 on 05/18/2022 6:07 PM
> Limiting documents to online viewing is incredibly powerful and value-added

I realize that nobody here really cares about this, but this is so patently false and misleading that I can't help myself:
At best, this kind of system will guard against casual replication.
{1} "You joined my company. Gained our trust. Gained my trust. Then stole my code on your James Bond wrist watch."

That's my point. CICs are not guarding state secrets. This thread asks "what level of data security is appropriate for CIC documents?" Casual protection is all that's necessary.

I agree 100%.
BillD16 (Texas)
Posts: 974
Posted:
Quote:
Posted By SteveH35 on 05/18/2022 7:35 PM
Posted By BillD16 on 05/18/2022 6:07 PM
> Limiting documents to online viewing is incredibly powerful and value-added

I realize that nobody here really cares about this, but this is so patently false and misleading that I can't help myself:
At best, this kind of system will guard against casual replication.

That's my point. CICs are not guarding state secrets. This thread asks "what level of data security is appropriate for CIC documents?" Casual protection is all that's necessary.

Sure. Although there are easier ways to get casual protection. It’s the characterization as “incredibly powerful and value-added” that I object to.

BillD

HOA Board ex-President
Austin, Texas USA

“You can’t put too much water in a nuclear reactor”

🎯 You've read this entire discussion

Join the conversation with 50,000 HOA & Condo Leaders:

  • ✓ Ask follow-up questions
  • ✓ Share your experience
  • ✓ Get expert advice
  • ✓ Access 350,000 discussions
Create Free Account →

⚡ Takes 30 seconds

Already a member? Log in here