Upgrade StorageSecurity Assurances
Hi,
I've been asked to assess Zotero for installation on a corporate device. After reviewing the available documentation, I've developed the recommendation below and would appreciate feedback on whether this approach is viable or whether I've misunderstood anything.
My recommendation is to:
Install the latest version of the Zotero desktop application.
Install the latest version of the Zotero browser extension.
Configure Zotero to synchronise bibliographic data only with Zotero's servers.
Exclude file synchronisation from the solution so files remain stored locally.
Instruct users not to use the Groups feature.
My understanding is that this would retain most functionality, but files saved in Zotero would only be available on the local device. If a user signed in on another device, they would be able to see the synchronised bibliographic data (for example, citation details, author and publication information), but not retrieve copies of the locally stored files.
One question I have is whether it is possible to block or disable access to the Groups feature.
For context, there are concerns about sensitive information being accidentally uploaded to Zotero's servers. These relate both to general data-exfiltration risks and to data residency, as our requirements mandate that data is stored in the UK rather than the USA. There is also concern about the possibility of files being shared through Groups for malicious purposes.
I've been asked to assess Zotero for installation on a corporate device. After reviewing the available documentation, I've developed the recommendation below and would appreciate feedback on whether this approach is viable or whether I've misunderstood anything.
My recommendation is to:
Install the latest version of the Zotero desktop application.
Install the latest version of the Zotero browser extension.
Configure Zotero to synchronise bibliographic data only with Zotero's servers.
Exclude file synchronisation from the solution so files remain stored locally.
Instruct users not to use the Groups feature.
My understanding is that this would retain most functionality, but files saved in Zotero would only be available on the local device. If a user signed in on another device, they would be able to see the synchronised bibliographic data (for example, citation details, author and publication information), but not retrieve copies of the locally stored files.
One question I have is whether it is possible to block or disable access to the Groups feature.
For context, there are concerns about sensitive information being accidentally uploaded to Zotero's servers. These relate both to general data-exfiltration risks and to data residency, as our requirements mandate that data is stored in the UK rather than the USA. There is also concern about the possibility of files being shared through Groups for malicious purposes.