The client portal
Clients never see the staff dashboard. They act through the client portal — a focused, magic-link surface that shows exactly the one task in front of them and nothing else.
Magic-link access
Clients authenticate with a magic link: a short-lived (48h), single-purpose token sent by email, hashed in the database. There is no client password. The link's token carries the product and the resource it's for, so the [token] portal page routes the client straight to the correct surface:
- a payroll intake form, or an approval request;
- a bookkeeping unreconciled-items list to respond to;
- a financial-statements preview to review and approve or request revisions;
- an XBRL UEN confirmation and sign-off.
For sensitive actions a client may be asked for an additional factor. Signatories are identified through the signature service at the point of signing.
What clients can and can't do
Clients supply data, confirm, and sign where they are the lawful signatory. They cannot approve a regulated action — that decision always belongs to a tenant operator at the human gate. A client approver approving a payroll cycle is approving the client's own data, not the regulated filing.
Group vs entity scope
A group-scoped client login (a Group Principal) resolves to a portfolio across the whole group, including entities in different jurisdictions, each rendered in its own jurisdiction's language and rules. An entity-scoped login resolves to one company.
How staff see it
Everything the platform sends a client is recorded in the Outbox (/dashboard/outbox) with its dispatch status. When a client says they didn't get a link or an email, the Outbox is the first place to look — see Verify an email was sent.
Related
- Intake channels — how client submissions arrive.
- Roles & permissions — client-contact roles.