Jonker IT A client portal holds exactly what criminals look for: ID copies, Wwft files, income and bank details. That is why the Customer Portal is built with security in layers. Below is what is in place today, in plain language.
1In short
- Invitation only and two-step sign-in for everyone.
- Optional: staff sign in only through Microsoft 365, with an emergency account for when Microsoft is unreachable.
- Optional: management only from the networks you choose, such as the office or the VPN.
- Every upload scanned with Microsoft Defender; infected files go to quarantine.
- Files are read in a separate, locked-down helper process.
- Security alerts by email and an update warning.
- Encrypted secrets, minimal rights in Microsoft 365 and only the proxy facing the internet.
- No BSN and an audit log of everything that happens.
- A “Security” page that shows whether the server and the settings are in order, with advice per item.
2Who gets in
Invitation only
- Nobody can create an account on their own.
- Invitations work once and expire by themselves.
- The first installation asks for a code that exists only on the server itself.
Two-step sign-in for everyone
- Clients and staff: a password plus a code from an authenticator app.
- Lost your phone? A safe reset with a single-use link.
- After a reset every remembered device has to give the code again.
Staff through Microsoft 365 NEW
- Switch it on and staff sign in only with their Microsoft 365 account, with your own organisation’s MFA and policies. When someone leaves, you switch them off in Microsoft.
- One owner keeps an emergency account for when Microsoft is unreachable. It only works from the trusted networks, and every owner gets an email when it is used.
- You can’t lock yourself out: the setting can only be switched on after a successful Microsoft sign-in.
Management only from your own network NEW
- Switch it on and the management side and staff sign-in are limited to the networks you choose, such as the office and the VPN. Elsewhere it says “Not available from this network”.
- Even with a stolen password nobody gets in from outside. Clients notice nothing.
- You can’t lock yourself out here either, and the restriction can be switched off on the server itself.
Lockout
- After repeated wrong attempts an account is locked for a while.
- Limits on signing in, uploading and lookups.
- The sign-in error never reveals whether an account exists.
Change your own password NEW
- Everyone can change their own password, with the current password and the code from the authenticator app.
- A confirmation follows by e-mail, and the change is recorded.
3Everyone sees only their own
- Every client sees only their own company and files; the server checks this on every request.
- A stakeholder with their own login, such as a UBO, sees only their own details. Their ID is private: the company’s contacts don’t see it either.
- Advisors see and manage only their own clients, unless an administrator deliberately gives them access to all clients. Only an administrator or owner can delete a company or reset a client’s 2FA.
- Incoming mail is only linked to a client automatically on addresses your firm confirmed, never on your own firm’s domain. Mail that fails the sender check (SPF, DKIM, DMARC) waits for review.
- Clients never enter SharePoint themselves.
- A client’s new IBAN is only used after your firm confirmed it.
4Safe with files
Only safe file types
- Programs, scripts and Office files with macros are always refused.
- A file’s content must match its extension; a disguised file doesn’t get in.
Virus scan of every upload NEW
- Every upload is scanned with Microsoft Defender (built into Windows) before it is stored or read: uploads by clients and staff, email attachments, ZIP files and everything in them, ID photos and training documents.
- Infected? The file is refused, put in quarantine, recorded and reported straight away to the owners and the advisor.
- You can choose to refuse uploads while the virus scanner isn’t working.
Reading in a locked-down helper NEW
- PDFs, Office files and photos are read in a separate helper process: without network access, without access to the database or keys, with limited memory and a time limit.
- A booby-trapped file can at most make that helper crash, never the portal.
- The file is then marked “could not be read” and the portal carries on.
No BSN
- The portal never asks for a BSN (Dutch citizen service number) and has no field for it anywhere.
- On copies of passports and ID cards the BSN is blacked out for good, existing copies included. The original is not kept.
- The BSN is also removed from the recognised text of documents before it is stored.
- Training documents are stored encrypted and deleted after use.
5Encryption and keys
- HTTPS on every part of the route: from the browser to the proxy, from the proxy to the portal and from the portal to Microsoft 365.
- Uploads travel over an encrypted connection to SharePoint, where Microsoft stores them encrypted.
- Secrets are stored encrypted and bound to the server: two-step sign-in keys, API keys, certificates and the backup password. A copy of the database alone is not enough to use them.
- Microsoft 365 works with a certificate instead of a password; the private key never leaves the server.
- Backups are encrypted (AES-256) with a strong password only your firm knows. The portal can make one for you.
- Backups go to a SharePoint library of their own that only owners can open, or to your own SFTP server.
6Microsoft 365 with minimal rights
- The portal may write to one SharePoint site, not to the rest of your Microsoft 365 environment.
- The portal may only send email as that one shared mailbox.
- For the list of colleagues it reads profiles only (name, job title), no mailboxes or files.
- Clients never sign in with Microsoft; that is for staff only.
7Server and network
- Only the reverse proxy faces the internet. The portal itself only accepts traffic from the proxy.
- Portal and proxy each run under their own limited Windows service account, not as administrator.
- Strict security headers, cookies that are not shared with other sites and protection against forged forms.
- No version information in the server’s responses, and a maximum size per request.
- A status address for monitoring from outside.
8Oversight and alerts
“Security” page NEW
- One overview for owners and administrators: BitLocker, Microsoft Defender, Windows updates, firewall, data folder rights, backups and test restores, the backup password, staff 2FA, certificates and the portal and .NET versions.
- Green, orange or red, and for every point that needs attention exactly what to do, with a ready-made command.
- A scheduled check reads the Windows settings every six hours; anything red shows on the dashboard.
Audit log
- Every sign-in, upload, opened file and change is recorded, with filters and export.
- Delete a client and their history stays in the log.
- You choose how long the log is kept (two years by default, or forever). Clean-ups are recorded too.
Security alerts NEW
- Owners get an email and a line on the dashboard for: many failed sign-ins, a new administrator or owner, a two-step sign-in reset, an account opening an unusual number of files, a client entering a new IBAN, a staff sign-in from abroad and a virus in an upload.
- No flood of email: at most one email an hour about the same thing.
Update warning NEW
- The portal checks daily whether a newer version exists and shows “There is a security update” on the dashboard and the server’s status screen.
- New versions also bring the latest .NET security updates.
- The portal never installs anything itself; your firm chooses the moment.
9What your firm arranges
Security is also about how things are set up. The “Security” page in the portal helps with that. What we advise your firm:
- Use the server only as a server: not for email or browsing.
- Switch on disk encryption (BitLocker), Windows Update and Microsoft Defender.
- Open only what the web server needs on the router. Remote management goes through a VPN.
- Keep a copy of the backups offline too, and practise a restore now and then.
- Set up SPF, DKIM and DMARC for your email domain; the portal’s DNS check helps.
- Agree with your clients: “We never ask for your password or code.”
10Questions?
All measures in one document to keep or share are in the security overview (in Dutch). Want to know more, for example for your own risk assessment or DPIA? Get in touch.