Client Portal: What It Is and How to Set One Up the Right Way

A client portal is a private, signed-in space where each of your clients sees only their own files, requests, project status and invoices, and nothing that belongs to anyone else. The method in one line: decide what a client needs to see, give every client contact a personal sign-in, filter every page by who is signed in, and test it as a stranger before anyone real logs in. If you landed here looking for a specific company's client portal login, go to that firm's website or the email it sent you. This guide is for the business building one.

What a client portal is for (and what it replaces)

Most small firms run client work through email threads, shared drive links and a spreadsheet only the team can see. That works with five clients. With thirty, files go missing in inboxes, people ask where are we on this? every week, and a link meant for one client gets forwarded to someone else. A portal replaces those channels with one address. The client signs in, uploads what you asked for, sees the current status and downloads what you delivered. Your team stops answering status emails and starts updating one record.

A self-service customer portal pushes the idea further. Instead of only reading, the client acts: submits a request, approves a draft, pays an invoice or updates their own details. Every action a client completes alone is a message your team never has to send. The trade-off is design work. Each self-service action needs a rule about who may do it and what happens next, and those rules are where most portals go wrong.

The five parts every client portal needs

Whatever you build it with, a working portal has the same parts. Skip one and the portal quietly turns back into email.

Sign-in that belongs to one person

Every client contact gets their own account, not a shared password for the whole company. Personal accounts let you remove the one person who leaves without locking out everyone else. They also tell you who uploaded, approved or deleted what, which matters the first time a client disputes a deadline.

A view filtered per client

This is the heart of it. Client A's pages show client A's records only. The filter has to run on the server, not just hide things on the screen. Otherwise a curious user can still pull the data through the browser.

Files in both directions

A place to upload what you need from clients and to download what you deliver, attached to that client's record instead of floating in a shared folder that someone has to tidy.

Requests and status

A form for new requests and one status field per job, so where are we? gets answered without a call. Keep the status list short. Four honest stages beat ten vague ones.

Your brand

Your logo and, ideally, your own domain. Clients trust a login page that looks like you, and one consistent address teaches them which login page is the real one.

How to set up a client portal, step by step

1. List what clients ask you for. Read the last month of client email and group the questions. Status, files and invoices usually cover most of it.
2. Pick the records. Usually clients, contacts, jobs or projects, files, requests and invoices. Each record carries the client it belongs to.
3. Write the access rule in one sentence. For example: a contact sees jobs where the job's client equals the contact's client. Everything else follows from that rule.
4. Choose the sign-in method. Email and password at minimum. A one-time code or Google sign-in is easier for clients who forget passwords.
5. Build three screens first. My jobs, upload a file, new request. Add invoices and approvals later.
6. Seed two fake clients and give each a few jobs and files.
7. Test as a stranger. Sign in as fake client A and try to reach client B's records by every route: search, a copied link, a changed ID in the address bar. Then sign out and try again with no account at all.
8. Invite one friendly real client. Watch where they get stuck, fix it, then roll out to the rest.

You can run a rough version of this for free with shared folders, a form and a spreadsheet. Our walkthrough on how to create a client portal with Google Drive and Forms shows the setup and the exact point where it breaks.

What makes a secure client portal

A secure client portal depends less on the tool's marketing and more on four habits. First, access rules enforced on the server. Hiding a button or a column is not security; if the data reaches the browser, someone can read it. Second, a second sign-in factor. CISA's guidance for small businesses says strong passwords alone are no longer enough and recommends requiring multifactor authentication, starting with admin accounts and employees who handle sensitive data ^[1]. Turn it on for your team first, then offer it to clients.

Third, avoid links that skip sign-in. A permanent link that opens a client's page without a password works fine until the client forwards that email. Fourth, review who still has access every quarter: a client's former employees, outside contractors, your own ex-staff. Removing people is the step everyone forgets.

Keep secrets out of the build as well. Don't paste API keys or real client data into an AI builder's chat. Check where the tool stores data before anything confidential goes in.

HIPAA-compliant client portal: what the rule asks

If you are a therapist, a clinic, a medical billing service or anyone else handling protected health information, the bar is higher. Under the HIPAA Privacy Rule, a covered entity may let a business associate create, receive, maintain or transmit protected health information on its behalf only after obtaining satisfactory assurance that the associate will safeguard it, documented in a written contract, and a business associate must get the same assurance from any subcontractor that handles the data ^[2]. In practice, the company that hosts your portal's data has to sign that contract, usually called a business associate agreement, or BAA.

That narrows the field fast. Lovable and Base44 say they are not HIPAA compliant and sign no BAA. Glide's rules prohibit HIPAA-protected health information in apps, in both GlideOS and Glide Classic. Softr makes no HIPAA claim and says it depends on the data source you connect. No builder makes you compliant by itself. You need a signed agreement from every party that stores the data, plus your own policies and training. Ask for the BAA in writing before you build a single screen.

An example: a small bookkeeping firm's portal

The firm in this example is invented and its numbers are round. A bookkeeping firm with 40 business clients and 3 staff finds that most of its email traffic comes from two questions: did you get my receipts? and is my return filed? It sets up a portal with three screens per client: an upload page for receipts and statements, a list of jobs with one status each (waiting on documents, in progress, filed), and a page of delivered reports.

Each client contact signs in with their own email. The access rule says a contact sees jobs and files where the client matches their own company, and staff see everything. Before launch, someone signs in as a test client and tries to open another client's job by editing the link. It fails, which is the point. The status question now answers itself. Receipts arrive attached to the right job instead of buried in a thread.

Common mistakes

• One shared login per company.
• Filtering on the page instead of on the server.
• Launching without a stranger test.
• Building twenty screens before clients use three.
• No offboarding, so old contacts keep access for years.

Tools that build a client portal for you

Once the homemade version gets crowded, a builder turns the per-client filter, sign-in and branding into settings instead of workarounds. Softr is built around this job, and it maps most directly onto the five parts above, as our guide to Softr's client portal setup for agencies shows. A firm like the bookkeeping example could start from a template instead of a blank app.

Bubble suits the portal where each client is a company with several contacts, the multi-tenant pattern we cover for startups. It is also where the stranger test in step 7 earns its place, because a privacy rule you forget to set leaves data readable.

Glide Classic takes the row-by-row route: each signed-in client gets only their rows, which is the one-sentence access rule from step 3 turned into a setting.

Prompt-to-app builders such as Lovable, Replit, Bolt.new and Base44 can also produce a portal from a description. The per-client rules are then yours to write and review. For every option grouped by situation, see our guide to client portal software.

One access rule, three screens, one real client

Judge the portal by what disappears: the status email, the lost attachment and the forwarded link. Build it around one access rule, personal sign-ins, a server-side filter per client and a stranger test before launch. Add a second sign-in factor for anyone who handles sensitive data, and if health information is involved, get a business associate agreement before anything else. Start with three screens, watch one real client use them, and only then add the rest.