Please add ability to restrict Company Persons in Customer Cheat Sheet email share

I have a real problem with Gainsight’s position that the ability to share the raw Customer Cheat Sheet with external customers is “expected behavior”.

I find it very hard to believe that companies would want users to share the raw results of cheat sheet with a customer when these can includes summarizations of Timeline entries, many of which are likely not intended to be consumed by customers. This is a VERY risky thing for Gainsight just to assume is a function customers want. Do we really want summarized versions of Renewal conversations and what we consider to be Risks/Issues to be shared without being able to sanitize the content? I think NO.
 

Additionally, the email that goes out to contacts includes this footer:
 

That hyperlink is a direct link to the C360 in my Salesforce tenant and drops the contact to our OKTA login page.

https://customurl.vf.force.com/apex/GainsightNXT#customersuccess360??cid=1P022FXMF6W9999999999VML17JX3JL7DK46&nxtInstance=v1&x-gs-host=SALESFORCE&j=eyJzX2FvaSI6IjAwRDUwMDAwMDAwNzJ1WUVBUSIsInNfYXNpIjoiMDBENTAwMDAwMDA3MnVZIUFRRUFRTGkzNTFYM1JXQVhrc3pfZGVwZC5fdE9UWEM3a0RDVDhBYWhUQ0hXX0U2THd0RHZqUnhaMXh6YmhiV0YudTNtLkFScFVMYXp6c010QnNQaVRhNl9Memk5dUdGQiIsInNfYXVpIjoiMDA1SHMwMDAwMENVVTJqSUFIIiwicl9o
 

So if sharing externally is “expected behavior” I assume that Gainsight really intentionally included this internal URL on a template that goes out to external Contacts? 

🤔

This is a big problem IMO.

One hundred percent.

Not to mention the MASSIVE privacy concerns this presents. Once that data gets out of Gainsight and into a user’s inbox, who’s to say where it’ll go next?

Agreed

With kindness, I am very surprised that Gainsight has allowed for the cheat sheet to be shared externally at all. I’ll even go so far as to say that I’d be completely okay with this not being possible whatsoever. If clients really needed this information surfaced to them, account teams can send them an email with updates, but timeline entries should be internal-only in my opinion.

In chatting with @kstim, it just hit me…

Couldn’t there be a “limit sharing” toggle, similar to how report sharing works? There definitely need to be some admin-level controls around this feature to prevent accidental issues.

I agree with everybody. This should be a no-brainer!

Internal data is for internal consumption, there are a lot of risks and privacy concerns to even allowing the Customer Cheat Sheet to be shared. At least, give the Admins the capability to turn on sharing, I strongly feel that disabled should be the default status with something so sensitive.

☝ THIS. Disabled should absolutely be the default status for sharing.

What makes the most sense to me would be for Admins to be able to allow INTERNAL sharing based on user permissions, if there are any options to share. But external sharing should not be possible. It’s not as if someone can’t copy and paste that information anyways.

💯 The default position for any sharing functionality should always be OFF, allowing admins to determine when and to whom sharing is enabled.

I will not allow launch of Customer Cheat Sheet in my environment until this is fixed.

Thank you for reaching out and sharing your feedback regarding this functionality of Cheat Sheet. We truly appreciate your insights and the opportunity to address your concerns.
The current behavior i.e allowing the sharing of raw Cheat Sheets externally was primarily driven by the need for flexibility within organizations, cases where users do not have Gainsight licenses but need to get a quick overview of the state of their customers will be benefited from this.

We understand your concerns about the potential risks associated with this approach and the importance of safeguarding sensitive information.
We have decided to implement below as a fix:
1. Warning Message: A warning banner will now be displayed when including external contact/company person in the recipient list, alerting users to potential risks.
2. Removal of External Links: We’ve added two links at the end of the recipient list (To & CC sections) labeled ‘Remove External Links.’ Clicking these will promptly remove any external contact/company person from the email.
3. Adjustment of Email Footer: Links leading to internal resources, such as the direct link to the C360 in your Salesforce tenant, will be excluded from emails when they are being sent to external contacts.

We believe these solutions strike a balance between flexibility and security, allowing for seamless collaboration while safeguarding sensitive information. We are also discussing admin controls down the roadmap.
Please do let us know your thoughts on this and if the above proposed solution addresses your concerns adequately
​​​​@Brayden, @shantan_reddy

@AshutoshSingh Thank you for moving so quickly on this! While this is a step in the right direction, I still strongly feel that admin controls should be prioritized, specifically controls around being able to toggle on/off the ability to externally share cheat sheet in general.