How can I configure Cloud Confluence to host projects from several clients?

[Brian Catanzaro]

I run a consulting business.  I'd like to use Cloud Confluence to update customers on their projects.  It seems like a perfect tool for this type of collaboration.  However, I cannot figure out how to keep customers from being aware of each other.

Permissions can be used to keep Customer A's personnel from seeing Customer B's Space.  However, I don't understand how to maintain their privacy in the context of user names / messaging / updates / ...

My fear is that Customer A will log in to my Cloud Confluence.  As they are authoring a page, they may refer to me or somebody else using @username.  The auto-complete may fill in Customer B's username, disclosing some information that is intended to be private.

Are there examples of users that have hosted a service based business or a consulting practice using Cloud Confluence to have isolated pages for isolated clients?

Without this, I'd be forced to create a new Confluence site (at a new cost) for each client (and configure this site).

Suggestions?

[Kris G _Alacriz_]

Hi @Brian Catanzaro- 

Giving customers the ability to host sensitive information across spaces is the purpose of Confluence. Of course, you need to make sure you understand the concepts like spaces, security, permissions, restrictions, etc in Confluence to be able to use them in a foolproof way (add to it, thorough testing). 

To answer your question in specific, Confluence groups are what you need to leverage for users belonging to different organizations. That way, even if @mention is visible, users will not be able to access specific content unless they have appropriate permissions. 

Please go through the following post that is related to this topic : https://community.atlassian.com/t5/Confluence-questions/What-are-the-best-practices-with-Confluence-restricted-pages/qaq-p/345653

I hope that helps. 

best,
Kris G 

[Brian Catanzaro]

Thank you for guiding me... I'll take a look and try to make this work using your suggestion!

[Brian Catanzaro]

I'm struggling a bit.  I think I understand the concepts.  Here's my test configuration:

• Group A (only permitted to see Space A)
• Group B (only permitted to see Space B)

The only user that is a member of both groups is me.

I am logged in as another user to test the configuration and it is not as I expect.

1. Log in as a user in A.  I can reference users from B merely with @username.  That's not what I want.  I should never be able to see users from Group B, right?
2. Log in as user in B.  This user was reconfigured to not be in Group A and only be in Group B.  However, they can still see Space A.  That's also not what I want.

A few questions:

• Is logging in as another user an effective test?
• When using Confluence Server, I had to reboot at one point to get settings to stick.  Obviously I cannot do that with Confluence Cloud.  Do I need to wait for configurations to take effect?  Do I need to do something to make them stick?

[Brian Catanzaro]

Seems like https://community.atlassian.com/t5/Confluence-questions/What-are-the-best-practices-with-Confluence-restricted-pages/qaq-p/345653 implies that you cannot block users from identifying other users in Confluence.

So, if I have (x2) clients, they may be restricted to their own space, but the auto-complete on messaging will allow themselves to see each other, ruining the confidentiality I wish to maintain, forcing me to have (x1) site for each client.

[Brian Catanzaro]

This:  ( https://jira.atlassian.com/browse/CONFSERVER-1882 ) also implies that users can always see other users regardless of Groups / Space permissions / ...  Is this true?

[Kris G _Alacriz_]

That's true, unfortunately, @Brian Catanzaro. 

We hope Atlassian comes up with a solution soon to address this persistent issue of being able to visit others' profiles and usernames if the users belong to different groups. As you correctly pointed out, the stated links mention potential customers to turn away from this powerful tool. 

The ability of users to visit spaces that they have no permission to access can be set using appropriate security rules though. 

best,
Kris G