I find it very disturbing that the emailed link to customer statements had no password security; anyone that gets the link will be able to see them. And for that matter, I assume Quickfile staff.
Either password protect or provide direct download when logged in?
I’m very new to using the software so may have missed how to do this ‘properly’.
Hi @henryg
The links are encoded and difficult to guess - for example, they contain more than just alphanumeric characters. My colleague explains this a bit more here, using an example string from the URL:
If you wish, you can force the client to enter a password. This can be enabled on a client-by-client basis:
Hope that helps!
I understand what you say, but nevertheless emailed bulk statements are HORRIBLY INSECURE. Anyone that gets hold of the email would seem to be able to click on the link and download them without any further security validation. I would never use this feature again; it may even be a breach of my GDPR obligations. And what about Quickfile staff having access should they be so inclined? This is not good enough IMO.
This should be a function that is available by download from within the program. It would then be up to the user to secure them properly. I suspect the solution implemented is some form of kludge to get round a missing feature.
I am sorry if I appear harsh in my comments as the system is good overall, but security is a prime concern for me.
I see where you’re coming from and I can see your point, but the simple option is to just not use that feature if you don’t like it. It is not a kludge or workaround, Quickfile are not the only ones that use this method of pre-authorising links, and how it is any less secure than just sending the invoices and statements as PDF attachments? I think you are trying to make this into a problem when in reality there isn’t one.
Hi @henryg,
There is also the option for your clients to log in - so rather than having a pre-authorised link they would be prompted to log into their client portal.
Only in so far as when you click a pre-auth link like this it gives you access to everything in that client’s account including all their previous invoices, whereas sending a PDF only gives access to that one specific document.
There are at least as many interpretations of GDPR requirements as there are lawyers interpreting them, but I know that the payroll provider I use no longer allows emailing of payslips and P60s as unencrypted PDFs - I had to generate and send an encryption password to each employee, which they now have to enter into Adobe Reader whenever they want to view a payslip.
This topic was automatically closed after 7 days. New replies are no longer allowed.