Client Portal#

The Client Portal gives one of your customers a secure, branded window into the records you choose to share— without a password and without access to anything else in your workspace. You share it from a Company record; your client opens a magic link from their email and sees that company’s shared records (Projects by default) grouped by pipeline stage, downloads the files you’ve attached, uploads files back to yourcloud storage, exchanges comments with your team, and manages which update emails they receive. You decide — per record type and per field — exactly what’s visible. It’s the customer-facing companion to Projects.

Everything the client sees is scoped to the single company you shared from, and to the types and fields you’ve allowed. They can read, comment, and upload — but they can never edit a record, advance a stage, see another customer, or reach the rest of your CRM.

What your client sees#

After opening the magic link, the client lands on a branded home page carrying your logo and name (“Powered by {Your Company}”). The record types you’ve shared appear there; a type with pipeline stages (like Projects) is grouped into collapsible stage sections — the same stage names, colors, and order your team uses internally — each with a count, a status rollup, and a file count. The whole view is mobile-friendly and stacks into cards on a phone.

Clicking a project opens its detail page: the current status, stage, and type; a Filespanel where each file downloads in one click (and, when you’ve enabled uploads, a drop-zone to send files back); and a Comments panel for back-and-forth with your team.

Configuring what’s shared#

Under Admin → Settings → Portal you decide which record types and fields the portal can ever expose. Nothing is shown to a client unless you turn it on here.

• →Shareable record types.Projects is on by default. Check additional types to share them, or uncheck Projects to share something else. Each shared type shows on the client’s home, grouped by stage when it has a pipeline.
• →Per-field visibility. Open a type’s Configure panel and check exactly which fields clients see. Fields are hidden by default (opt-in) — a hidden field is physically absent from what the client’s browser receives, not just visually hidden. The record’s name is always shown.
• →Per-type features. The same panel has toggles for Show files, Show comments, Allow client uploads, and Email client on staff reply.

Sharing a portal#

You share a portal from the customer’s Company record. The contact you pick must be a saved contact with an email address.

1. 1Open the Company record for the customer you want to share with.
2. 2Click Share portalin the record’s action bar.
3. 3Search for and select the contact who should receive access (they need an email on file).
4. 4Choose Link expires — 30, 60, or 90 days, or Never— and, if you’ve connected Dropbox, optionally pick the Client uploads folder.
5. 5Click Send magic link →. The contact is emailed a secure link to their portal.

Client file uploads#

Clients can upload files straight into your own Dropbox — Coeffection never stores the bytes. When you pick a root folder in the Share-portal modal (and the record type has Allow client uploads enabled), the portal auto-creates a /{Project}/client-uploadssubfolder, and the client gets a drop-zone on that project’s Files panel.

• •Accepts common document and image types (PDF, PNG, JPG, DOCX, XLSX, ZIP) up to 50 MB; other types and oversized files are rejected with an inline message.
• •New uploads notify your team, and they appear in the project’s file list. A staff Preview of the portal stays read-only — no drop-zone.

Comments & email notifications#

Each shared record has a two-way comment thread, and email flows in both directions:

• →When your client posts a comment, the record’s owner and watchers are emailed so your team can respond.
• →When your team updates a record the client is subscribed to — such as a stage change, or (when you enable it) a staff reply to a comment — the client is emailed so they stay in the loop.

The Email client on staff reply toggle lives per record type in Admin → Settings → Portal. It’s off by default; turn it on and an opted-in client is emailed when your team replies to a comment — never about their own comment. See Notifications for how customer-facing emails are configured overall.

Client notification preferences#

Clients manage their own notification emails right from the portal — no account needed, and every email is CAN-SPAM compliant.

• →“Get Notified” widget. A card on the portal home lets a client opt in (with a confirmation email — double opt-in) and choose which updates they want: project status changes and comment replies. Already-subscribed clients see a quiet Manage notifications control to change or turn them off.
• →One-click unsubscribe. Every notification email carries a branded unsubscribe link that opens a confirmation page on your portal and stops the emails — re-subscribing is one click from there.

A client only ever receives emails after they’ve confirmed, and only for the company that was shared with them.

Managing access#

• •Multi-use link with the expiry you set.The magic link works every time within its window (30, 60, 90 days, or Never), so an email scanner pre-opening the link can’t lock your client out. Opening it starts a portal session so they stay signed in without re-clicking the email.
• •Re-share. Resending from Share portal issues a fresh link to the same contact.
• •Sign out.The client can end their session from the portal header; they’ll need their link to return.
• •Revoke.Revoking access from the company’s Share dialog cuts off the link and session immediately.

Security & privacy#

The portal is a separate, low-privilege doorway into your workspace — it never grants any staff permission:

• ✓Hard-scoped to the one companyyou shared. A client can never load another customer’s record, file, or comment — those return “not found”.
• ✓You control visibility. Only the record types and fields you allow are ever exposed — fields are hidden by default and a hidden field is physically absent from what the client receives. Internal data never leaks.
• ✓Records are read-only. Clients view, download, comment, and (where you enable it) upload files into your storage — they cannot edit records or change stages.
• ✓Secure tokens, a link expiry you choose, and access you can cut off instantly.