Hiding a button does not protect the data

A whistleblowing channel, in an international group. The confidentiality rule is simple: each reporter reads only their own reports. The question is where this rule lives.

The false security of the interface

The quickest solution is the interface. You hide the case-handling screen from reporters. You make the button that opens other people's cases invisible. On screen, everything looks protected.

The problem is that the data hasn't moved. It's still there, behind the screen. It stays accessible to anyone who knows where to look.

Hiding a button doesn't remove a right. It removes a path. And a hidden path isn't a closed path.

It gets worse. Protection set screen by screen has to be redone for every new screen. The day you add a report, an export or a new page, you have to remember to set it again. One oversight is all it takes.

How I turned the logic around

In this tool, the rule "each reporter reads only their own reports" isn't written in the interface. It's enforced by the platform's permissions, at the data level.

In practice, when a reporter asks for cases, the platform returns only their own. The others aren't hidden. They simply aren't sent to them.

The application decides nothing. It observes what the rights allow, and shows what it receives.

The test that counts is this one: even by going around the interface, a user cannot read someone else's report. It isn't the screen that stops them. It's the data itself, protected where it's stored.

The interface is just a courtesy

I sum up the idea like this: security must live in the data, the interface is just a courtesy.

The interface is still useful. It avoids showing a button that would lead nowhere. It makes the tool clearer, more pleasant. But it doesn't protect.

This logic has another advantage. Each person's role is deduced from the same rights. The central team reads everything, each reporter reads their own reports, and the application derives the screens to show from that. One rule, in one place, for security and for display.

So there aren't two systems to keep aligned, one for the rights and one for the screens. There's only one. The screens follow the rights, never the other way around.

Why it matters for compliance

In a whistleblowing channel, confidentiality is at the heart of the system. A reporter must be able to count on it.

On the day of an inspection, the question won't be "is the button hidden?". It will be "who can read what, and how do you prove it?".

With interface security, the answer is fragile. It depends on every screen, every button, every possible oversight.

With permissions at the data level, the answer fits in one rule. And that rule applies everywhere, including where nobody thought to put a screen.

It's also simpler to maintain. A new screen has nothing to set up again: it reads the same data, with the same rights, and shows only what they allow.

What this means for you

If your tools hold sensitive data, ask your technical team a simple question: "if someone goes around the screen, what do they see?"

• If the answer is "nothing, their rights prevent it", security lives in the data.
• If the answer is "they won't find the button", security lives in the interface. It holds until the day someone looks.
• If nobody can answer, that's already an answer.

Payroll data, disciplinary files, reports, contracts: everything confidential deserves the same question. The answer must not depend on a screen.

The same tool deduces each person's role from their rights, with no list to maintain: no list of administrators. It also watches its own deadlines: regulatory deadlines watched by the tool. The full project is in the case study A whistleblowing channel that watches its own deadlines. This kind of tool is described on the page An application instead of the Excel file.

Confidential data is protected where it's stored. Not where it's displayed.