Secure Access to Conversation Attachments in Chat To Clients CRM
Chat To Clients CRM is introducing enhanced security for conversation attachments to better protect sensitive customer information. Applications accessing attachments outside Chat To Clients CRM will require additional file access permissions and authenticated access.
This update initially applies to email conversation attachments, with other channels planned for future phases. Affected developers must update their applications by November 30, 2026.What Is Secure Conversation Attachment Access?
Secure Conversation Attachment Access is a permission-based security model that controls how external applications retrieve conversation files. Instead of relying on directly accessible attachment links, applications must have the appropriate permissions and authenticated access.
This enhancement strengthens data protection and supports Chat To Clients CRM's HIPAA compliance and security requirements while maintaining the existing experience for most users.
Key Benefits of Secure Conversation Attachment Access
The updated security model helps businesses protect confidential files while providing greater control over application access.
Enhanced Data Security: Protect sensitive conversation attachments from unauthorized access.
Permission-Based Access: Allow only appropriately authorized applications to retrieve protected files.
Improved Compliance Support: Strengthen safeguards supporting HIPAA and security requirements.
Controlled Application Access: Require authenticated requests when external applications retrieve attachments.
Consistent File Security: Establish a foundation for secure attachment access across additional channels.
How Conversation Attachment Access Is Changing
The update introduces new access requirements for applications retrieving email conversation attachments outside Chat To Clients CRM.
| Current Experience | Updated Experience |
|---|---|
| Attachment links can be accessed directly. | Protected attachment access requires authorization. |
| Existing attachment URL format. | New, more secure attachment URL format. |
| Existing application permissions. | Additional file access permission required. |
| Existing integrations can use their current links during the transition. | Affected integrations must be updated by November 30, 2026. |
Important: Existing attachment links will continue working only through the transition period ending November 30, 2026. Developers should complete migration before this deadline.
The initial phase covers email conversation attachments only. Other conversation channels and file-based custom fields are planned for future phases.
Who Is Affected by This Update?
The security enhancement primarily affects developers and applications that access or display conversation attachments outside Chat To Clients CRM.
Regular Chat To Clients CRM Users: No changes are expected when accessing attachments directly within Chat To Clients CRM.
Marketplace Developers: Must update applications that retrieve email conversation attachments externally.
Users of Affected Applications: Must reauthorize their applications to grant the additional permission.
Applications Without Attachment Access: No action is required.
This distinction helps businesses identify whether they need to take action before the migration deadline.
Attachment Permissions and Application Reauthorization
External applications must have the necessary file access permission before retrieving protected email attachments. Existing users must reauthorize affected applications to grant the updated access. Developers should update their application's permission configuration and ensure that attachment retrieval uses authenticated requests.
Reauthorization is required because existing permissions do not automatically grant the new file access permission.
For information about Marketplace permissions, see API Security – OAuth Consent for Marketplace Apps.
How to Prepare for Secure Attachment Access
Developers should review their existing integrations and complete the required updates before November 30, 2026. Preparing in advance helps prevent interruptions when the new access controls take effect.
Review Your Application: Identify whether it retrieves or displays email conversation attachments outside Chat To Clients CRM.
Update Permissions: Add the required file access permission to your Marketplace application.
Update Attachment Retrieval: Modify integrations to use authenticated access and the updated attachment format.
Request Reauthorization: Ask existing users to reauthorize the application with the additional permission.
Test Attachment Access: Verify that authorized applications can retrieve attachments and that unauthorized requests are appropriately restricted.
Complete Migration: Deploy and verify the required changes before November 30, 2026.
For technical implementation details, refer to the Conversation Attachment API Documentation.
Frequently Asked Questions
Q: Will this change affect attachments viewed directly in Chat To Clients CRM?
No changes are expected for users viewing attachments within Chat To Clients CRM.
Q: Which conversation channels are affected?
The initial phase applies to email conversation attachments. Other channels and file-based custom fields are planned for future phases.
Q: What happens to existing attachment links after November 30, 2026?
Existing directly accessible attachment links will no longer be supported under the previous access model. Applications must use the updated permission-based access process.
Q: Do existing Marketplace applications require reauthorization?
Yes, if they access affected attachments. Existing users must reauthorize these applications to grant the additional file access permission.
Q: What happens if developers do not update their applications?
Applications relying on the previous attachment access method may no longer be able to retrieve protected email
attachments after the transition.
Q: Do applications that do not access conversation attachments need to take action?
No. Applications that do not retrieve or display conversation attachments are not affected.