Client Portal
Give clients a secure, professional window into their project without creating accounts or sharing login credentials. They see what you choose to show — project status, progress, and invoices. Nothing more.
What the Client Portal Does
- Shows clients their project status and task completion progress
- Lets clients view and download PDF invoices
- Automatically marks an invoice as 'Viewed' when a client opens it (audit trail)
- Logs every portal access with a timestamp for your records
- Requires no client account or password — access is via a secure link
What the Client Portal does NOT do
- No write operations — clients cannot comment, approve, or upload files
- No financial internals — billing rates, cost rates, margin %, and time entry details are never shown
- No online payments (coming soon)
- No access to other clients' data — each link is scoped to a single contact
The Client Portal is available on the Growth and Scale plans. It's designed for professional service firms that want to reduce client status-update emails without giving clients full access to your operational system.
How Authentication Works
The portal uses token-based authentication, not username/password. When you generate a portal link, ACOS creates a unique UUID token. That token is the only credential needed — anyone with the link can view the data.
The portal URL looks like: app.acos.auricorium.com/portal/<uuid-token>/
Treat the portal link like a password. If you suspect it has been shared with the wrong person, revoke it immediately and generate a new one. Revoking takes effect instantly on the next request.
Generating a Portal Link
Open the contact record for your client
Go to CRM → Contacts and find the contact. Scroll to the Portal Access section at the bottom of the contact detail page.
Click Share Portal Access
The Portal Access Modal opens.
Optionally set an expiry date
By default, portal links never expire. If you want the link to stop working after a project is complete, set an expiry date.
Copy the link
Click Copy to Clipboard. Send it to your client via email or your preferred communication channel.
One portal link is generated per contact. If you regenerate a new link, the old link is automatically revoked. There is no limit to how many times you can access the portal with the same link.
What Clients See
Project list
The portal shows all projects linked to the client contact. Each project card displays:
- Project name
- Project status badge (Planning, Active, On Hold, Completed)
- Task progress: a circular progress ring showing completed tasks ÷ total tasks
Project detail
Clicking a project opens a two-tab view:
| Tab | What clients see |
|---|---|
| Overview | Status, description, start and end dates, progress bar, and team member first names only (no rates, no job titles, no contact details) |
| Invoices | Table of invoices for this project: invoice number, amount, status, due date, Download PDF button |
Invoice list
Clients can also see all their invoices across all projects from a top-level Invoices page in the portal. Overdue invoices (past due date, not paid) show the due date in red.
When a client opens an invoice in the portal, ACOS automatically sets the invoice status from "Sent" to "Viewed". This appears in your invoice list so you know the client has seen the invoice — useful for following up on late payments.
Portal Access Logs
Every request to the portal is logged: which token was used, which URL was accessed, and the timestamp. These logs are stored in the portal_access_logs table and give you an audit trail of client activity.
You can see recent portal activity on the contact detail page (Portal Access section) — the last access timestamp is shown next to the active link.
Revoking Access
Go to the contact's Portal Access section
The section shows the active link and a Revoke Access button.
Click Revoke Access
The token is immediately deactivated (is_active = false).
Confirm
Any attempt to access the portal with the old link will immediately return a 'This link is invalid or has expired' page.
After revoking, you can generate a new link for the same contact. The access logs for the old token are preserved — you keep the history of when the client accessed the portal.
Security Considerations
- Token is the credential — never post portal links publicly (social media, public documents). Treat them like a shared password.
- Data scoping is strict — each portal token is tied to a single contact. A client can only see projects and invoices linked to their contact record. They cannot access other clients' data even if they guess a URL pattern.
- No financial internals — billing rates, cost rates, margin percentages, and hourly breakdowns are never exposed via the portal endpoints.
- Invalid tokens return 404 — not 401 or 403. Returning a 404 for invalid tokens is standard security practice (Notion and Dropbox share links work the same way). It prevents token enumeration attacks.
- Set expiry dates for completed projects — once a project is closed and all invoices are paid, revoke or set an expiry on the portal link so former clients cannot continuously access historical data.
Roles & Permissions
| Action | Member | Manager | Admin | Owner |
|---|---|---|---|---|
| Generate portal links | ✗ | ✓ | ✓ | ✓ |
| View existing links | ✗ | ✓ | ✓ | ✓ |
| Revoke portal access | ✗ | ✓ | ✓ | ✓ |
| View access logs | ✗ | ✓ | ✓ | ✓ |
Best Practices
- Share the portal link when a project kicks off, not when you first send an invoice. Clients who have been checking progress updates are less surprised by invoices.
- Tell clients what the link gives them access to — and what it doesn't. Setting expectations prevents 'I can't see X in the portal' support requests.
- Set an expiry date for project-based engagements. For retainer clients with ongoing work, permanent links make sense.
- Revoke access if a project contact changes (e.g. your main point of contact leaves the client company). Generate a new link for the replacement.
- Check the Viewed status on invoices to confirm receipt before following up on payment. If an invoice hasn't been viewed, your first follow-up should confirm the client has the link.
FAQ
Can I share the same portal link with multiple people at the client company?
Yes — the link can be shared with multiple people at the client. All access is logged. If you need to revoke access for one specific person, you'll need to revoke the link entirely and generate a new one for the remaining contacts.
Can clients leave comments or request changes through the portal?
Not currently. The portal is intentionally read-only in the current version. Client collaboration features (comments, file sharing, approval workflows) are on the roadmap.
What does the client see if my invoice is in Draft status?
Draft invoices are not visible in the client portal. Only invoices with status Sent, Viewed, Paid, or Overdue appear. Clients never see draft or cancelled invoices.
The portal shows my projects but the client says they can't see a specific project.
Verify that the project's contact field is set to the same contact that the portal token was generated for. If the project is linked to a company contact but the portal was generated for a person at that company, the project may not appear. Check the contact linkage on both the project and the portal token.