SuitePortalSuitePortal
Security

Access Controls & Permissions

Role-based access control for your NetSuite customer portal. User authentication, API security, and permission management to control who sees what data.

SuitePortal gives you control over who can access your portal and what they can do.

User Authentication

Every user must prove who they are before accessing the portal.

Authentication Features

FeatureWhat It Does
Email verificationConfirms the user owns their email
Password requirementsStrong passwords required
Session managementAutomatic logout after inactivity
Multi-factor authenticationAdditional security layer (enterprise)

Role-Based Access

What users can do depends on their role.

Role Capabilities

RoleView DataTake ActionsManage UsersConfigure Settings
Admin
Member
Viewer

What "Take Actions" Means

Actions include things like:

  • Making payments
  • Downloading documents
  • Submitting requests

Viewers can see information but cannot make changes or take actions.

API Access Controls

If you use the API extension.

API Security Features

ControlWhat It Does
API keysEach integration gets its own key
Scoped permissionsKeys can be limited to specific data
Rate limitingPrevents abuse and ensures fair usage
RevocationInstantly disable compromised keys

Managing Access

How to manage user access in your portal.

Changing User Roles

  1. Go to Users
  2. Click on the user's name
  3. Select a new role
  4. Save changes

Changes take effect immediately.

Removing a User

  1. Go to Users
  2. Find the user
  3. Click Remove
  4. Confirm

The user loses access immediately but their historical data remains for your records.

Best Practices

Tips for managing access securely.

Principle of Least Privilege

  • Use the least privilege necessary — Start users with Viewer access and upgrade as needed
  • Review access regularly — Remove users who no longer need access

Credential Security

  • Use strong passwords — Enforce password requirements
  • Monitor API keys — Rotate keys periodically and revoke unused ones

On this page