Privacy

What V Portal is

V Portal (v3.vportal.ae) is Visioneers' internal platform for the employees of the group's companies. You sign in to it with your work account at Microsoft or Google.

How you sign in

V Portal has no passwords of its own and never sees yours. Microsoft or Google checks who you are, with any multi-factor authentication they ask for, and then tells V Portal.

If you type your work email on the sign-in page, V Portal uses the part after the @ only to send you to the right provider, and passes the email to the provider to fill in. It doesn't store what you type.

What V Portal asks for

Only what it needs to know who you are: your name, your email address and an ID for your account, which Microsoft and Google call the openid, email and profile scopes. It doesn't ask for access to your mail, files, calendar, contacts or anything else in your account.

What V Portal receives and checks

Your provider sends V Portal a signed token, called an ID token, with your name, your email address, your account's ID at the provider, and the details V Portal checks below. A token from Google can also hold a link to your profile photo.

V Portal checks that the token comes from your provider and was issued to V Portal, and that your account is one of the group's work accounts:

• Microsoft: an account in Visioneers' organisation at Microsoft, as a member rather than a guest, with an email at a domain the organisation has verified with Microsoft.
• Google: an account in one of the group's Google Workspace domains, with an email Google has verified.

Then it lets you in only if your email is the work email of a current employee, and you signed in with the provider your email's domain uses: each of the group's email domains signs in with one provider only. While nobody can sign in as the portal's top admin, as when it's first set up, a few admins named in its settings can sign in too.

The first time you sign in with a provider, V Portal stores your account's ID at that provider, and later sign-ins with it must come from the same account.

What V Portal keeps

Besides the sign-in log (below), V Portal keeps:

• Your sign-in: the email you sign in with, the name your provider gave the first time you signed in, and the provider and account ID you sign in with. In the portal, an employee's name comes from their employee record, not from the provider.
• Your sessions: when each one started, when it was last used and when it ends, the provider, and the network (IP) address and browser it was started from.

It doesn't take your photo from Microsoft or Google: it doesn't keep the photo link a Google token can hold, and doesn't ask Microsoft for your photo. It keeps none of the tokens your provider sends, so it can't act in your Microsoft or Google account.

Sessions and cookies

When you sign in, V Portal keeps your session on its server, and your browser keeps a cookie that ties it to the session. The cookie holds only a signed key, which the page's scripts can't read. It lasts as long as a session can, 7 days at most, and signing out removes it.

A session ends after 12 hours without activity, or 7 days after signing in. It also ends when you sign out, when an admin signs you out everywhere, or when your access ends, for example when you leave or your work email is removed.

While you sign in, a second cookie, kept for 10 minutes at most, lets V Portal check that what comes back from your provider is the sign-in your browser started. If you choose a theme in the portal (light, dark or your device's), a cookie remembers it for a year.

The load balancer in front of the portal sets two cookies of its own, AWSALB and AWSALBCORS, each kept for 7 days after your last visit. While a new version of the portal starts, they keep your browser on the copy that served its page. They say nothing about who you are. V Portal uses no other cookies.

The sign-in log

V Portal logs every sign-in, refused sign-in, sign-out and session end: when it happened, the provider, the result and, for a refusal or a session end, the reason. When V Portal has them, it also logs whose sign-in it was, the email address the provider sent, the account ID at the provider, the session, and the network (IP) address and browser.

A refused sign-in is logged with the email address the provider sent, even when it isn't anyone's work email, such as a personal account's.

In the portal, only admins whose role allows it can see the log. Those whose role lets them see people's sign-ins can see each person's sign-in history and active sessions, with the network address and browser. Those whose role lets them resolve flagged sign-ins can see the sign-ins V Portal flagged, such as one from a different account from the one on record.

The portal's audit log also records changes to your sign-in, such as a new email or a different Microsoft or Google account on record, and each time an admin signs you out everywhere or resolves a flagged sign-in: who did it, when, and any reason they gave. Those admins can see these entries, and so can admins whose role lets them see the audit log.

What V Portal uses it for

Only to sign people in, to keep the portal secure, and to record who changed what in it.

V Portal doesn't sell this information, and doesn't share it outside Visioneers, except with the services that run the portal for it. Amazon Web Services hosts the portal, its database and its backups in its Mumbai region. SendGrid sends the portal's emails.

How it's protected

V Portal is served only over encrypted connections (HTTPS), and tells browsers to open it only that way.

Its database is encrypted where it's stored, and so are its backups. V Portal's connection to the database is encrypted too, and checks the database's certificate.

Each page for signed-in people checks their session on the server, every time it opens, and each admin page checks that the admin's role allows what it shows.