// client_portals

Client Portal Development

Secure customer-facing platforms: accounts, documents, status tracking, billing. The surface your clients touch — engineered so one tenant can never see another.

// what_we_build

What We Build

Client dashboards

One login where your clients see their projects, status, and history. Reads are scoped to their tenant at the database, not filtered in the UI.

Document exchange

Upload, review, and delivery flows with per-file access scoping. Every download is authorized and logged — including the ones from expired links.

Status & timeline views

Live progress your clients check instead of emailing you. State comes from the system of record, so the timeline never lies.

Billing & subscription portals

Invoices, payment methods, plan changes. Wired to the payment provider through webhooks and reconciled, so the portal and the ledger agree.

Multi-tenant SaaS

Portals that grow into products. Tenant isolation, roles, and billing are designed as architecture from the first migration.

// how_portals_fail

How Portals Fail

A portal is an attack surface with your clients’ data behind it. These failures are not hypothetical — they are the standard ways customer-facing platforms leak.

TENANT_DATA_LEAK

Client A changes an ID in the URL and reads Client B’s invoices. The query filtered by nothing but trust.

Counter: Isolation is enforced with row-level security at the database. Every query carries the tenant, and cross-tenant access is tested as an attack before launch.

BROKEN_MAGIC_LINK_AUTH

A login link gets forwarded, or a corporate email scanner clicks it first and burns it. Either way, auth breaks in the field.

Counter: Links are single-use, short-lived, and bound to the requesting session — with a confirmation step that survives the scanners.

STALE_STATUS_STATE

The portal says “in review” while the work shipped days ago. The client stops trusting the portal and starts emailing again.

Counter: Status is read from the operational system, not mirrored by hand. When a sync fails, the portal shows the failure instead of the old state.

FILE_ACCESS_WITHOUT_SCOPE

A signed file URL leaks in a forwarded email — and works for anyone, forever.

Counter: File access runs through short-lived, per-user grants tied to tenant scope. Nothing sensitive lives behind a URL that never expires.

// evidence

Evidence

lab_build

Client Portal

A portal build documented end to end: tenant isolation, magic-link auth, scoped document access.

view build→

field_note

Multi-Tenant Data Isolation

Why UI-level filtering is not isolation, and how row-level security closes the gap.

read note→

// faq

Questions

How is client data isolated?
At the database layer, with row-level security — not in application code alone. Every table carries a tenant boundary, every query is scoped to it, and cross-tenant access is tested as an attack before launch. Read the isolation note →
Do you support SSO and magic links?
Yes. Magic links for low-friction client access, password plus 2FA where policy requires it, and SSO — Google, Microsoft, SAML — when your clients’ IT departments demand it. The right option depends on who logs in and what they can reach.
What does a client portal cost?
Typical portal builds land in the $15k-$40k range, depending on auth requirements, document handling, and billing integration. Multi-tenant SaaS platforms go beyond that. Discovery fixes the number before the build starts.
Can the portal integrate with our existing systems?
That is usually the point. Portals read from your CRM, project tracker, or billing system so clients see live truth instead of a copy. Integration boundaries and sync failure handling are mapped in Discovery.
How long does a portal build take?
Most portals run 4-8 weeks of build, 6-12 weeks across the full lifecycle. Auth requirements and third-party integrations are the variables that move the timeline.

If clients email for status because they do not trust the portal — or there is no portal — Discovery is the next step.

start --build