Client Portal Sign-In and Account Security Policy

Purpose

Your client portal account holds confidential information about your matter. This policy explains how signing in works, what we do to protect your account, what you can do, and what to do if you are locked out or think someone else has used your account. It works alongside our Client Portal Terms of Use.

Ways to sign in

• Email and password. Before you sign in with a password for the first time, you confirm your email address by entering a 6-digit code we email you. The code works only for a short time.
• Google or Microsoft. You can sign in with a Google account, or a personal Microsoft account such as Outlook.com or Hotmail. To sign in to an account you already have, use one with the same email address as your portal account. Microsoft work and school accounts can't be used.
• Facebook. You can open a new account with Facebook. Facebook can't be added to an account you opened another way: sign in to that account with your email and password, Google or Microsoft.
• More than one email. If we have more than one email address for you, you can sign in with any of them. Sign-in codes and password-reset links go to the main email address on your account.

Passwords

• Your password must be 8 to 128 characters. Any characters can be used, including spaces, so a long phrase that is easy for you to remember works well.
• Use a password you don't use anywhere else.
• If we set up your account for you, we may email you a temporary password. You must choose your own the first time you sign in.
• We store only a scrambled form of your password, so no one at NEO can read it.
• We will never ask for your password. Never share it, or a code we email you, with anyone, including someone who says they are from NEO.

Staying signed in

• If you tick "Remember me on this device" when you sign in, you stay signed in on that device for 30 days, and that period is renewed while you keep using the portal. If you don't tick it, you are usually signed out when you close your browser.
• On a shared or public device, don't tick "Remember me", and sign out when you finish.

How we protect your account

1. Limits on attempts. We limit how often anyone can try to sign in, ask for a code or reset a password.
2. Failed sign-in alerts. If the wrong password or code is entered for your account four times or more within an hour, we email you the time, the rough location, the IP address and the device of the attempts. While it goes on, we email you at most once an hour. Someone trying to get in sees the same message whether or not an account exists for that email.
3. Changing your password needs your current password, and signs you out on every other device.
4. Changing your email address needs your current password and a code sent to the new address. We also tell your old address about the change.
5. Reset links. Password-reset links are sent only to the main email address on your account, and we keep only a scrambled form of each link's key.
6. Your sign-in options. You can connect or disconnect Google or Microsoft in your Profile. If you opened your account with Facebook, you can disconnect it there once you have another way to sign in, but it can't be connected again. Your last way to sign in can't be removed.
7. Our team knows when you sign in. Our team is told when you sign in to the portal, at most once every few hours.
8. One account per person. Each email address and phone number can belong to only one account.
9. Our own accounts. Everyone at NEO signs in with their own account, and sees only what their role allows.
10. Deactivated accounts can't be used to sign in.

What you can do

• Keep your email account secure, with a strong password and two-step verification if your email provider offers it, because reset links and codes go there.
• Keep your devices up to date, and locked with a passcode.
• Be wary of any message that asks for your password or a code, or that looks like it is from us but links somewhere unfamiliar. Our Fraud Prevention Policy explains how to check.
• Tell us at once if your email address or phone number changes.

If you are locked out

• Forgot your password? Choose "Forgot password?" on the sign-in page, and we email a reset link to the main email address on your account.
• Can't get into your email? Call us. For your protection, we may ask you to confirm who you are before we change anything on your account.
• Has your account been deactivated? Contact us if you think it is a mistake. Suspending or closing an account never ends our duties on an open matter, as our Client Portal Terms of Use explain.

If you think someone else has used your account

1. Change your password at once. This signs you out on every other device.
2. Tell us straight away. Call us, and email info@neolegalservices.com with "Security" in the subject line.
3. Check your email account for signs that someone else has used it.
4. What we do. We may suspend your account while we look into it, and we deal with any risk to personal information under our Information Security and Data Breach Response Policy.

If you find a weakness in our portal's security, please report it under our Security Vulnerability Disclosure Policy.

Review

This policy is reviewed at least once a year, and whenever the Law Society's By-Laws or rules change. The principal approves every change. We also review it whenever the way people sign in to our portal changes.

Questions

Email info@neolegalservices.com, call 647-200-3526 or toll-free 888-519-2435, or write to us at Unit 236, 1099 Kingston Road, Pickering, Ontario L1V 1B5.