A private document needs access control beyond a noindex instruction

A noindex instruction can affect search-engine handling, but it does not itself prevent somebody from opening a file. If a document is private, the application needs to enforce access when the document is requested.

Follow the direct address

A Czech customer portal may hide a document link until login. Check whether the file's direct address is also protected. A hidden navigation item is not an adequate control if the address remains publicly retrievable.

Review the supporting routes

Thumbnails, previews, search snippets and exports can expose information too. The access decision should cover those representations, not only the main document page.

Use an agreed private test

Test fictional files with an authorized account, an unrelated account and no session. Include a permission change and an old saved link. Do not experiment against unrelated live records.

Keep professional assessment separate

The organization and its advisers define data responsibilities and the appropriate controls. A technical check of one route is not a complete security or legal assessment.

OWASP's authorization guidance explains relevant enforcement principles. Google's noindex documentation describes a separate search concern. Include both topics deliberately in a portal project.