Client Portal Security: What Agencies Should Ask Any Vendor
Short answer: A client portal holds your clients' project data, their files, often their credentials, and sometimes their invoices. You are taking on responsibility for that on their behalf. Eight questions separate vendors who have thought about this from those who haven't — and the answers matter more than any certification badge on a marketing page.
A note on this article: it's published by a portal vendor. The questions below are ones any agency should ask including of us. Where a vendor won't answer plainly, that's the finding.
The eight questions
1. Can one client ever see another client's data?
The foundational question for any multi-tenant product. Ask how isolation is enforced, not whether it exists. Every vendor says yes to "is it secure."
2. What exactly does a client see by default?
Opt-in or opt-out? A product where everything is visible unless you hide it will eventually expose something, because it depends on someone remembering. A product where nothing surfaces until you choose it fails safe.
3. How fast can I revoke access, and what does revoking cover?
When a relationship ends or a contact leaves, how long until they're out — and does revocation cover files and credentials they already had access to, or only the login?
4. If it stores credentials, how are they handled?
Are they encrypted at rest? Can access be time-limited? Can you see who accessed what and when? A product storing credentials without expiry, revocation and logging is a liability rather than a feature.
5. Is there an access log?
Not for surveillance — for answering "who saw this and when" during an incident or a dispute. Without it, that question has no answer.
6. Where is the data held, and who is the processor?
Some of your clients will have contractual or regulatory requirements about data location and sub-processors. You can't answer their questions if you can't answer this one.
7. What happens to the data if I leave?
Can you export it? In what format? How long is it retained afterward? Vendors who haven't thought about exit generally haven't thought about deletion either.
8. What's the actual answer on compliance claims?
If a vendor claims a certification, ask which one, its scope, and when it was last assessed. Scope is where the ambiguity usually lives — a certification covering one part of a business is often marketed as covering all of it.
What the answers tell you
You're not looking for perfection. Early products legitimately don't have every control a mature one does.
What you're looking for is whether the vendor answers specifically. "We take security very seriously" in response to a specific question is a non-answer, and it usually means nobody has done the work. A vendor who says "we don't have that yet, here's what we do have and here's when that's coming" is telling you more useful things than one with a badge and vague answers.
Ask a specific question. If you get a marketing sentence back, that is the finding.
Your own side of it
Vendor security only matters if your own practices aren't the weak point. Two things worth auditing regardless of what you buy:
Credentials in chat and task descriptions. Search your own systems for password, login and API key. Whatever you find has been there longer than you think and some of it belongs to people who no longer work with you.
Access that outlived its purpose. Former contractors, departed client contacts, temporary elevated permissions never rolled back.
Frequently asked questions
What should agencies ask a client portal vendor about security?
How tenant isolation is enforced, what clients see by default, how fast access can be revoked and what revocation covers, how credentials are handled, whether access is logged, where data is held, what happens on exit, and the precise scope of any compliance claim.
Is it safe to store client credentials in a portal?
It depends entirely on whether the product supports scoped access, expiry, instant revocation, access logging and encryption at rest. Without those, a credential store is a permanent unscoped copy — the same problem as a Slack message, in a nicer interface.
What's the biggest client data risk for agencies?
Usually not the vendor. It's credentials sitting in chat threads and task descriptions with no expiry and no record of who has seen them, often belonging to people who left months ago.
Does a small agency need to worry about this?
You hold your clients' data and access on their behalf, so the responsibility is the same regardless of your size. The controls can be simple; the questions still need answers.
The short version
Eight questions. Judge the specificity of the answers rather than the presence of badges. And audit your own chat and task descriptions first — the weakest link is usually inside your own systems rather than the vendor's.
Ask us these questions directly — 7 days of full access is $1.