The portal
Everyone outside your company is free.
Clients, vendors, candidates and auditors hold real accounts that reach exactly their own records — and none of them consumes a paid seat, because a seat is somebody who works at your company.
Charging for a customer’s account only teaches companies to email PDFs instead of granting access — which takes the work out of the system that governs it and puts it in an inbox that governs nothing.
Four kinds of outsider
What each one reaches, and what they cannot.
The right-hand column is the part worth reading. Anybody can list what an account can see; the question you are actually weighing is whether letting a client in exposes another client.
Clients
Free · unlimited
Sees
- Their own projects and where each stands
- Their invoices, and what is outstanding
- Tickets they raised, and the replies
- The purchase orders they sent you
Never sees
- Any other client's anything
- Your margin on their work
- What you pay the people delivering it
Vendors
Free · unlimited
Sees
- Purchase orders you sent them
- Bills they submitted against one
- What has been approved and what is pending
Never sees
- Another supplier's prices
- What you charge your client for it
- Anything about a bid they were not in
Candidates
Free · unlimited
Sees
- Their own application
- Which stage it has reached
- Interviews scheduled with them
Never sees
- Other candidates for the role
- Interviewer notes or scores
- The salary band
Auditors
Free · unlimited
Sees
- Read access to the scope agreed with you
- The audit trail for that scope
- Reports run through the same gates
Never sees
- Anything outside the agreed scope
- Write access of any kind
- An unlogged query — every report they run is recorded
How it is safe
Scope comes from the session, never from the request.
A portal account raises a ticket against its own account whatever it puts in the payload. There is no parameter that widens it, because the client it belongs to is read from the session — the request is not consulted on the question.
Underneath it is the same scope level the rest of the product uses: the sixth one, reaching a single external client. It runs through the same five gates as every internal request, so there is no separate portal codebase to secure twice — which is the usual place this goes wrong.
