Device policies

Admin > Organisation > Devices has switches that make it harder to copy mail out of Bulwark on the devices people use. Each is off until you turn it on, for everyone or for a domain or group.

To turn a switch on:

1. Open Admin > Organisation > Devices.
2. Pick Everyone, or a domain or group, in the Applies to bar.
3. Switch on what you need.
4. Click Save.

What each switch does

What the server enforces

Two things are checked on Bulwark's server, so they hold even for a user who blocks requests in the browser or runs an old Bulwark version:

• The push text. Notifications get their text from Bulwark's server (/api/push/preview). Under Push without sender and subject it asks Stalwart for the message's id only, so the sender, subject and text never leave the server for the notification. What the push service (Google, Apple, Mozilla) carries was already ids only. This is the web app's push path; the Bulwark mobile app reads mail for its notifications itself and doesn't follow the switch yet.
• The office editor. When a document opens in Collabora or ONLYOFFICE, Bulwark's server tells the editor what this user may do: under No printing it turns printing off (DisablePrint, HidePrintOption), under No downloads or No export it turns export, "save a copy" and copying off (DisableExport, HideExportOption, HideSaveOption, DisableCopy), and Watermark sets WatermarkText. Collabora reads all of these. Other editors may ignore some of them, WatermarkText in particular; check yours.

For both, the server works out the user's domain and groups from their own JMAP session. Every group or shared mailbox in that session counts as a group here, so a scope matches rather more often than less. When the session can't be read (the mail server doesn't answer, an office editor link outlived its sign-in), every switch that Everyone or any scope turns on applies, and when the policy itself can't be read the editor turns everything off.

Everything else is checked in the browser only. Bulwark hides the buttons, and the code that hands out a file refuses as well, but someone who knows the browser's tools can fetch the mail from Stalwart themselves.

With several accounts

Each message follows the policy of the account it belongs to. In a unified inbox with a restricted work account and an unrestricted second account, attachments of the work account's mail can't be downloaded and those of the other account can.

What isn't about one message follows the strictest account signed in: the install prompt, Ctrl+P, the watermark on calendar and contacts printouts, and the Files app.

Plugins

Plugins can't get around the switches through Bulwark: under No downloads or No export a plugin can't save a file (ui.downloadFile), and under No printing it can't print (ui.print). A plugin with network access could still send what it reads somewhere else; only install plugins you trust. Plugins can also show their own notifications with any text, so Push without sender and subject doesn't cover them.

The policy file

The switches are organisation.devices:

{
  "organisation": {
    "devices": {
      "noDownloads": false,
      "noExport": true,
      "noPrint": false,
      "noInstallPrompt": false,
      "pushWithoutContent": true,
      "watermark": false
    }
  },
  "scopes": [
    {
      "id": "finance",
      "label": "Finance",
      "match": { "groups": ["finance@example.com"] },
      "policy": { "organisation": { "devices": { "noDownloads": true, "noPrint": true, "watermark": true } } }
    }
  ]
}

Keys a scope leaves out come from Everyone. noOffline in the same section belongs to offline mode.

Bulwark Lite

Lite has no server of its own, so every switch is checked in the browser. Lite has no push notifications and no office editor, so those two parts don't apply. The install prompt switch works in Lite.

What isn't possible

These stay out of reach of the switches:

• Forwarding. Users can forward a message, attachments included, to any address. Restrict outgoing mail in Stalwart (sending rules, allowed recipient domains) if that matters.

• Printing to a PDF. With only No downloads on, the browser's print dialog can still save a message as a PDF. Turn on No printing too.

• Copying to another account. "Copy to" another account signed in to Bulwark is offered only into an account whose switches are at least as strict, but mail copied by another app isn't covered.

• Pictures the message loads from the web. Under No downloads a right-click on a picture in a message offers no "Save image as", and pictures can't be dragged out; a picture that comes from a web address can still be opened at that address. Long-pressing a picture on some phones still offers to save it.

• Stopping screenshots or other apps. See the note at the top.

• Stopping Ctrl+P. Browsers don't let a page stop printing; Bulwark can only make the printout blank.

• Contacts and events. No export covers mail. Contacts can still be exported as vCard and events as .ics.

• The user's own files. Under No downloads users can still upload files and attach them; they can't download them again from Bulwark.

• A watermark that can't be removed. It is drawn over the page by Bulwark; the browser's tools can remove it, and it isn't part of the message.