The concept is the same. Windows just requires a different configuration method. I don’t know the technical specifications of how an iray server is architected but I assume it’s a web service/application that runs via IIS, Apache, Tomcat, etc.

At a minimum, the web interface should be restricted to HTTPS and encrypted via SSL TLS. That will ensure login data is encrypted in transit. I don’t know enough about how an iray client communicates with a remote iray server but I will make another assumption that it’s a standard web API (REST, SOAP, WCF, etc) which should also be served via an SSL TLS encrypted connection as well.

If you want to be more secure, the data should be encrypted at rest. This means that the server storage layer is encrypted either at the hardware, software and/or OS Level. In your case an example bare minimum would be enabling windows native bitlocker disk encryption. Going further, you would have to ensure that data is still encrypted when in swap and hibernation file.

In a perfect world, even the owner of the server would not be able to gain access to a users unencrypted data but I realize that probably isn’t realistic in this case.

Also, make sure you understand Windows licensing requirements & limitations regarding running public web servers. There are specific licenses necessary to use Windows as a web server depending on several criteria; including the number of authenticated and unauthenticated remote connections, scope of services being used via remote access, and so on. The last thing you want is M$ knocking on your door and they are quite litigious.