Decide what each client must see and do, start with shared folders and a form if you have a few clients, and move to a portal with real logins and per-client data when the list grows.
For anyone asking: How do I set up a client portal where clients log in to see their files and updates?
Each one's way of doing it, and the point where it stops.
One portal serves every client: each client signs in and sees only its own projects, tasks and invoices through user groups and conditional filters, checked on Softr's server. Where it stops: Apps are PWAs only, with no code export; Free is a pilot with a Softr badge and no custom domain.
Privacy rules check each data type, field and file on the server; a parent Company data type ties every record to one client company for multi-user clients. Where it stops: Without privacy rules any data sent to a device can be read; editor-uploaded files are not covered; no code export.
In Glide Classic, Row Owners give each client only their own rows, enforced on Glide's server, on a private app limited to your users table. Where it stops: Glide Classic Free cannot publish; Maker app users must use personal email addresses. GlideOS invites guests instead and fits only partly.
Lovable Cloud adds user accounts by prompt and lets you publish the app to invited people by email; per-client rules are built through prompts and reviewed by you. Where it stops: Invite-only publishing on Free and Pro is capped at a small number of people per project; not HIPAA compliant, no BAA.
The Agent builds the portal by chat on a PostgreSQL database, with Clerk sign-in under your branding for customers; per-client views are yours to build into the app. Where it stops: Replit Auth suits internal tools, not clients; Replit puts the app's compliance on the builder.
Bolt Database adds sign-up, login and app-user roles plus private file buckets; a project security audit in the Publish menu reviews access control before launch. Where it stops: A private site and a custom domain cannot be combined; Bolt calls its audit a first pass.
Data permission rules can make each record belong to one user, behind app login with email, Google or Microsoft; Base44 says the first build needs those rules added. Where it stops: Visitors' emails, uploads and AI calls spend the owner's integration credits and fail at zero; workspace data may train AI on every plan except Enterprise.
Every verdict rests on the data in our product reports, never on a fee. How we score →