Published and unpublished: keeping private records off a public archive website

A catalog holds more than you intend to show. Donor files, items under embargo, records still being described, material with unclear rights. The public website has to show the rest without ever touching those.

The website never reads the catalog database

Treat the catalog and the public website as two applications. Staff work in the collections management system, where every record lives. The website is built separately and reads from a search index that contains published records only. In the archive systems we build, the public website reads only the index of published records, never the catalog database. If the website has no route to the database, an unpublished record cannot leak through a search box or a guessed web address.

What publishing does

When a reviewer marks a record as published, the system adds that record to the public index. Unpublishing removes it from the index. The record in the catalog does not move or change. This is why a status field is worth more than a folder name. It is the single switch that controls what the public can find.

Review before anything goes out

Agree on a short set of states and who may move a record between them.

1. Draft. The cataloger is still working.
2. Ready for review. The cataloger has finished and asks for a check.
3. Approved. A reviewer has read the record, checked rights and cleared it.
4. Published. The record is in the public index.

The person who writes a record should not be the person who approves it. Keep the reviewer's comments with the record, so the cataloger can see what to fix.

Roles

• Cataloger. Creates and edits records, cannot publish.
• Reviewer. Approves and publishes within an assigned part of the collection.
• Administrator. Manages accounts, roles and settings.
• Read-only. Sees the catalog without changing it, for researchers or trustees.

We recommend one account per person with role permissions. Shared accounts make it impossible to tell who published a record, and they are rarely closed when someone leaves.

Records that are private but not secret

Some material should reach registered researchers, members or partner institutions, and no one else. Give those records a separate website that requires sign-in, built on its own index. Keep that site out of search engines. Mark its pages as not to be indexed, block it in the site's robots file and never link to it from the public site. A sign-in page that search engines have crawled is still a public page, so the record titles behind it must not appear in results.

Rights and permissions fields

Visibility has more than one switch. A record may be public while its image stays private. Give each record fields for copyright status, donor restrictions, any embargo date and the display rights for attached files. The website checks those fields before it shows an image or a download. A photograph with unclear rights can appear as a description with a note, while the image stays behind sign-in.

Test visibility before release

Test every feature that shows private records against the sign-in and visibility rules before release. Run development and testing against development data and indexes, never against the live system. Before a new site or feature goes live, work through this list.

• Open the site signed out. Search for an unpublished record by title and by identifier. Nothing should come back.
• Sign in with each role and confirm it sees only what its permissions allow.
• Open a record with an image restriction and confirm the image does not load, including at its direct address.
• Check the private site's pages are marked as not indexable, then search the web for one of its record titles.
• Unpublish a record and confirm it disappears from the public site within the agreed time.

Repeat the list after every change to search, sign-in or the index. These are the parts of the system where a visibility rule can quietly stop working.

Read more about how we build collections management systems and digital archives, including review, approval and publishing.