What is a client portal?

What a client portal holds

Most portals carry the same five things. A project overview with its status and the next milestone, so the client never has to ask where things are up to. A feed of updates, usually with a place for the client to reply, so decisions are written down next to the work they affect. A files area for briefs, drafts, contracts and final deliverables, always showing the latest version. Approvals, where the business asks a specific question such as "Is this floor plan final?" and the client answers Approve or Request changes with a comment, leaving a dated record. And invoices, ideally with a way to pay them. Some portals add messages, timesheets or a calendar, but those five are what clients actually open. An agency, an architect, a bookkeeper, a builder and a consultant all fit this shape; what changes is the vocabulary, not the structure.

How access works behind the screens

Each client has an account, and each project has a list of members. When the business creates a project, it sends the client an invite link; the client signs in or creates an account, and the link adds them to that project's member list. From then on, every read of a project, an update, a file or an approval is checked against that list. The check has to live in the database or the file store, not only in the page layout: if the page hides another client's project but the database would still return it, anyone who edits a request in the browser can see it. Files need the same rule. Confidential documents belong in private storage where a download is refused unless the person is a member of that project, with short lived signed links rather than public addresses that work forever once shared. Staff accounts sit above all of this and see every project they are allowed to manage.

When a portal is worth it

A portal pays off once a business runs more than a handful of projects at once and the same questions keep arriving: which file is the latest, did the client approve the second draft, has the deposit invoice been paid. It also matters when the work involves documents the client would not want sitting in an email account forever, such as identity documents, financial statements or signed contracts. For a sole trader with two clients a month, a well organised email folder may still be enough. A useful test is to count how often in a week someone searches their inbox for a client file or an approval. If the answer is several times, the time spent on that search is the cost a portal removes. Clients also tend to read updates more carefully in a portal, because the update is not competing with every other email they received that morning.

Common mistakes

The most serious mistake is access checked only by the screen, which is how one client ends up seeing another client's files. The second is matching people to projects by email address alone, so anyone who signs up with a similar or forwarded address inherits access; an invite token that is used once is safer. Others are quieter. Putting confidential files in a public storage bucket because it was quicker to set up. Letting approvals be edited after the fact, which turns the record into an opinion. Sending clients to the portal for some things and email for others, so neither is complete. Forgetting to remove a former employee of the client from the member list when they leave. And launching without moving the live projects across, which leaves the portal empty on the day clients first look at it and teaches them to keep using email.

Where it shows up in OneCraft

Ask for a client portal when generating a site and the AI builds it into the site's own database from its portal guide: projects with milestones, updates with comments, files, approvals with Approve or Request changes, and invoices, behind a Client login link, with a Projects tab when the site is a phone app. Each project's tables are guarded by a membership rule in the database, and the AI checks access as an anonymous visitor and as a signed in person before the step can finish. Files go to the site's private bucket, up to 25 MB a file, readable only by the project's members and staff. Clients join through an invite link the owner sends from their own mail, because the site cannot email clients itself. Paying invoices online uses Stripe Checkout on the owner's connected account, which the free plan cannot do.

Questions people ask