Customize the default question

When you send a secure message to a recipient who doesn't have a Send It Secure account, one way they can verify it's them is a Shared secret question & answer — a question whose answer you and your recipient both know and would agree on. The default question is intentionally generic so it works for any industry, but as an administrator you can replace it with one tailored to your organization.

Here is the Message Security Settings dialog a sender sees, where the question appears:

Message Security Settings dialog

Set your default question

You must be an administrator to change Message Security Settings for your organization.

  1. Sign in to your dashboard at app.senditsecure.com.
  2. Open Message Policies. Message Policies on the dashboard
  3. Click Edit on the message policy you want to change, or use the + button to create a new custom policy. Message Policies list
  4. Scroll down to find the Shared Secret Question section, and click Edit. Shared Secret Question section
  5. Check Customize this setting so you can edit it.
  6. Add your new question to the Options list, one question per line (include an example in the question text — see below).
  7. Select your new question as the Default Question.
  8. Scroll down and click Save Changes. Save Changes button

The question you set applies to the message policy you're editing — if your organization has more than one policy, each can have its own default question.

Don't forget to set your default message policy. For your new question to be the one your team actually sees, make sure this policy is set as your organization's default message policy (or the policy your senders select when composing). Senders can still choose a different question or verification method on any individual message.

Write a question that works

The best questions ask for something your recipient already knows, in one specific format, with an example right in the question so there's no guessing. For instance, “What is the 4-digit year of the patient's birth? (ex: 1999)” works far better than “When were you born?”

Examples by industry:

  • Healthcare / provider: “What is the 4-digit year of the patient's birth? (ex: 1999)”
  • Dental practice: “What is the patient's date of birth? (use mm-dd-yyyy — ex: 04-15-1999)”
  • Phone on file: “What are the last 4 digits of the phone number on file? (ex: 6789)”
  • Billing / accounts: “What is your account number? (the 7-digit number at the top of your invoice)”
  • Billing, with a format description: “What is your account number? (3 capital letters followed by 6 numbers, in the top-right corner of your invoice — ex: ABC123456)”
  • Legal: “What is your matter or case number? (ex: 2024-0427)”

Be careful of:

  • Answers that can be entered more than one way. A date is a classic trap — “04151999” vs. “15041999” vs. “4/15/1999” all feel right to different people. If you ask for a date, state the exact format (e.g. use mm-dd-yyyy — ex: 04-15-1999); otherwise ask for one piece, like the 4-digit year or the last 4 digits.
  • Public or easily guessed answers — a last name, company name, or street address. If someone else could look it up, it isn't a good secret.
  • More sensitive data than you need — don't build the question around a full Social Security Number, a full card number, or a full date of birth. A short, non-sensitive detail you both know is safer and just as effective.
  • Answers that change over time — a current balance or “last payment amount” may not match by the time the recipient opens the message. Pick something stable.
  • Spelling out the answer in the email. The question can point to where the answer lives (“the number at the top of your invoice”), but never include the answer itself.