Compliance & Security

Who Can See Which Account, and Why?

Being signed in isn't the same as being allowed. Nexum controls access by role, app, client and action.

Being signed in isn't the same as being allowed.

Summary

Authentication proves who someone is; authorization decides what they can see and do.

Access should depend on role, client, function, action and data sensitivity.

Nexum combines roles, per-user App Access, client-scoped portals, masked SSNs and logs.

Key takeaways

Map who needs which accounts and why.

Confine client users strictly to their portfolios.

See Nexum's access controls in a demo.

Authentication vs. authorization

Many systems check who you are and then show you everything. In collections, that's how SSNs, client portfolios and balance changes end up in the wrong hands.

The dimensions of access

Role. Collectors, supervisors, finance, administrators, owners, clients.

Client. Client users see only their own portfolio. Internally, some agencies restrict certain clients to qualified staff.

Function. Which apps and screens a person uses.

Action. View vs. edit vs. delete vs. export vs. approve.

Data sensitivity. Full SSNs, card details and medical information need tighter controls or shouldn't be displayed at all.

Design principles

Least privilege: grant the minimum needed.
Separation of duties: the person who changes a balance isn't the only one who reviews it.
Explicit client boundaries: never rely on client users "not clicking" somewhere.
Masking: display only what's needed (for example, last four of SSN).
Logging: record who accessed and changed what.

Review and test

Quarterly access reviews.
Immediate changes on role change or departure.
Boundary tests: sign in as a client and try to reach another client's data; sign in as a collector and try to reach settings.

Measure it

Users with elevated access.
Access review completion.
Boundary test results.

How Nexum controls access

Roles: agents, admins, owners and client (creditor) users with defined capabilities.
User Management: per-user App Access, suspension and sign-in history.
Client Portal: only the menus you allow, only the client's own portfolio.
SSNs encrypted and shown as the last four digits.
File Sharing: three access levels and an activity log.
Agency settings visible only to authorized administrators.

The bottom line

Every account should be visible only to people with a reason to see it. Nexum enforces that. See permissions are a business control.

See it working in your agency

Book a 30-minute guided Nexum demo built around your agency's real bottleneck, or call 502ZONE directly at (786) 524-4252. Nexum Open CRM is free: no license fee, no seat fees, no subscription. Add 502ZONE modules only when you want more recovery.

Bring us your most expensive collections problem.

Our guided 30-minute session focuses on your real workflow and the problem costing you the most.

Schedule a Demo