Secure client portal checklist for sensitive casework

Understand the information and threat model

Identify the categories of case information the portal will handle, their sensitivity, the people who may receive access, applicable confidentiality or privacy obligations, and the harm that could follow from misdirection, account compromise, or excessive access. Use this assessment to decide whether the service and configuration are appropriate.

Review supplier security, contractual terms, processing locations, subprocessors, incident notification, availability, backup and recovery, export, deletion, and support access. Sensitive workloads warrant more than a quick feature comparison.

Control identity and authorization

Use individual accounts, strong authentication, and role- or matter-based permissions. Verify the recipient through an appropriate channel before granting access, especially when names, email addresses, representatives, or family relationships could be confused. Avoid shared credentials.

• Default to least privilege and explicit matter membership
• Separate internal, client, expert, vendor, and other external roles
• Require additional approval for highly sensitive folders or actions
• Set expiry or review dates for temporary access
• Provide a visible list of everyone who currently has access

Make sharing understandable

Users should see the recipient, matter, document, permission, and expiry before confirming a share. Use clear notifications that do not expose sensitive content. Consider whether downloads, re-sharing, printing, or offline copies are appropriate, while recognizing that technical restrictions cannot eliminate every form of onward disclosure.

Maintain activity and security logs sufficient to investigate access, sharing, administrative changes, and important client actions. Protect those logs from inappropriate alteration and define who reviews alerts and how incidents are handled.

Operate the portal through the full lifecycle

Teach staff and clients how invitations work, how to verify unusual requests, where to report suspected compromise, and which channel to use for urgent communication. Periodically review inactive users, open links, broad permissions, returned emails, and matters that have closed.

On closure or relationship change, revoke access, provide any required export, preserve the organization's record, and apply retention or deletion decisions. Test recovery and incident procedures before they are needed.

Is a client portal safer than sending email attachments?

A well-operated client portal can centralize permissions and make it easier to review who can access a shared record. Whether it is safer for a particular use depends on identity checks, configuration, recipient behavior, and the information involved. A portal with broad permissions or shared passwords can create serious risks despite using encrypted connections.

Use the communication method that fits the matter and the recipient's needs. Some clients need an assisted process or an alternative accessible channel. Record how sensitive documents will be delivered, how recipients are verified, and where urgent messages should go. A portal notification should not be assumed to satisfy a formal service or delivery requirement unless that has been established for the situation.

Example: share one document without exposing the whole matter

Consider a fictional matter in which an external accountant needs one statement. The case owner verifies the intended recipient and grants only the access needed for that task. Before releasing the invitation, the owner checks the document version, matter association, permission scope, and review or expiry date. Internal notes and unrelated correspondence remain outside that permission.

After the assignment ends, the team reviews and revokes ongoing access where appropriate. Revoking portal access cannot retrieve a copy already downloaded by the recipient. The sharing decision therefore needs to consider permitted onward use, document sensitivity, and any relevant agreements before the file is released.

What should teams test before adopting a client portal?

Test with separate internal and external accounts using representative, non-sensitive sample records. Confirm what an invited user can see before accepting, after accepting, and after access is removed. Test the wrong account, an expired invitation, a direct document link, and a user assigned to a different matter. These checks assess authorization behavior more clearly than a feature list.

Ask how administrators recover access, investigate suspicious activity, export records, and close accounts. Confirm which events are logged and whether the organization can obtain those records when needed. Treat statements about security certifications or data location as claims to verify against the provider's current evidence and contract.

• Recipient verification and individual account controls
• Matter and document access under realistic external-user roles
• Invitation expiry, revocation, and direct-link behavior
• Accessible instructions and a clear support route
• Export, retention, incident handling, and supplier evidence