X-com
·10 min read·by X-com Editorial

The Secure Client Portal Checklist (26 Items)

Auth, encryption, RLS, audit, invitations, uploads, and incident response — the actual checklist a secure client portal has to pass.

A secure client portal isn't a feature — it's 26 small decisions that all have to be right. This is the checklist we hand to prospects who ask "how do I know this is safe?" It maps to SOC 2 controls and the NIST Cybersecurity Framework.

Authentication

  1. Passwordless email + OAuth (Google, Microsoft) as the default.
  2. Per-user sessions, never a shared team login.
  3. Session rotation on privilege change.
  4. Rate-limited login endpoint.

Authorization

  1. Row Level Security-style row-level security enforced at the database, not the app layer.
  2. Role-based access with a separate user_roles table (never a role column on the profile).
  3. Every mutation checked against workspace membership server-side.
  4. Impersonation banner visible whenever staff acts on a customer's behalf.

Data at rest and in transit

  1. TLS 1.3 with HSTS.
  2. AES-256 at rest for the database.
  3. Signed URLs for file downloads, expiring in minutes not hours.
  4. Attachments virus-scanned before signed URL issuance.

Invitations

  1. Raw invite tokens delivered only in email — never stored in DB.
  2. DB stores SHA-256 token_hash only.
  3. Invites time-bound with explicit expires_at.
  4. Single-use — status flips to redeemed atomically.

Full model documented in our invitation security model.

Audit and logging

  1. Every admin action written to an append-only audit log.
  2. Login and failed-login events with source IP.
  3. Downloadable audit trail for compliance reviews.

Compliance and process

  1. GDPR-compliant data export and deletion.
  2. Subprocessor list published (see our /trust page).
  3. Incident response runbook with 72-hour breach notification.
  4. Annual pen test by a third party.
  5. Continuous scanning against the OWASP Top 10.

Vendors that can't produce this list on request don't take security seriously. See our trust center for how we handle each of the 26.

Frequently asked questions

What makes a client portal secure?
A secure client portal enforces per-user authentication, database-level row-level security for tenant isolation, hashed and single-use invitation tokens, short-lived signed URLs for file downloads, and an append-only audit log for every admin action.
Is a client portal SOC 2 compliant by default?
No product is compliant on its own — SOC 2 is a set of controls the vendor implements and audits. A portal makes SOC 2 achievable by providing the technical primitives (RLS, audit logs, encryption, incident response), which you then map to Trust Services Criteria during an audit.
How are file uploads secured in a client portal?
Uploads should be scanned for malware, stored encrypted at rest, and only ever served through signed URLs that expire in minutes rather than hours. The signed URL should be reissued per request and tied to the caller's session.

Try X-com free

Flat workspace pricing. Invite every client, partner, and collaborator without paying per seat.

Start freeSee pricing