Recipient groups and routing by category

By default every report is encrypted towards all the channel’s active key holders. With groups you can narrow this down: for instance “IT security (NIS2)” reports are read only by the “IT Security” group, “Privacy” reports only by the DPO and legal counsel.

How to

1. In step 4 open the “Recipient groups and routing by category” card and create a group: name, description, members chosen among the channel’s key holders.
2. In the routing table choose, for each category, “All channel key holders” or a group.
3. Press “Save routing”. From then on the portal encrypts reports of that category only towards the group’s recipients and tells the reporter under the category (“will be read by the group: …”).

The rules

• A group that receives a category must have at least one active holder of the content key: otherwise nobody would read those reports (the console prevents it).
• If the group has no holders of the identity or metadata key, those compartments stay with the channel’s ordinary holders.
• A group cannot be deleted while a category uses it, and the last reader of a group that receives categories cannot be deactivated.
• The server rejects reports encrypted towards holders outside the group: the group is a perimeter, not a hint.