What Your Clients Actually See in the Portal

A client login is not a smaller version of your portal. It is a different portal, and the difference is enforced by the database rather than by hiding buttons. This guide is what a client user sees, so you can answer that question in a sales call without guessing.

Findings

Two sections. Findings your testers wrote on an engagement, and findings that came from a vulnerability scan, kept apart because they are different kinds of work and a customer reading them should know which is which.

A finding appears when two things are true: the engagement has been delivered or approved, or the finding has been published individually, and the finding itself is marked visible to the client. Neither on its own is enough.

They can select findings and mark them read or unread, and request a retest on anything eligible. A retest request is a request: it lands with you and changes nothing about the finding until a tester acts on it.

Marking read is per person, not per company. One client user clearing their list does not clear a colleague’s.

Documents

The reports, attestation letters and vulnerability reports you have released, as downloads. Nothing appears here automatically; a document reaches a client when you deliver it.

What they cannot see

This is the part worth being precise about, because it is what a security questionnaire asks.

• Other clients. Every read is filtered by the client the user belongs to, in policies on your database, not in the application.
• Engagements that are not delivered, and findings not marked visible, including anything a tester is still drafting.
• Your internal comments, QA review, checklists, the Library and anything on the scanning side beyond their own runs.
• Your other users beyond the lead tester named on their own report.
• Cost, margin, invoices you have not issued to them, and anything about your firm’s own account.

Giving somebody access

Clients, then the client, then add a portal user with their name and email address. They receive a sign-in email, set a password and enrol a second factor under the same policy as everybody else. You can change that address later, and both the old and the new mailbox are told when you do, because re-pointing a sign-in address is the shape of an account takeover and the old address is the only one that would notice.

A client user is never offered as a lead tester, never counts against your internal user limit, and cannot be given an internal role. If somebody needs both, they need two accounts.