Customer portal
Purpose
The customer portal gives customers their own access to what concerns them — documents, work items, notifications — without anybody having to supply them individually.
At its core is a dividing line: the portal is a separate sign-in area, not a restricted view of the internal system. By construction a portal account cannot reach the internal area — not even through a wrongly set permission. That separation is why the portal can be opened up without having to reconsider data leaks with every change.
Scope
- Its own sign-in with its own accounts, its own layout and its own permission logic.
- Access by invitation only. A contact record never creates access by itself.
- Object-bound releases instead of roles: rights are granted on a specific customer, project or
contract, each with individually selectable capabilities.
- Files need their own release. Seeing a customer does not make their documents visible — each
file carries its own portal marker.
- Three states per access: invited, active, suspended. Suspending preserves the history.
- A dedicated AI assistant with a considerably narrower, fail-closed slice.
- Anti-enumeration: what may not be visible answers "not found" rather than "no access" —
otherwise the answer alone would reveal that the record exists.
Interplay
Access is managed under Portal access and hangs off contacts. Released files come from the file store, messages from communication.
Limits
- No crossing into the internal area. The two sign-in areas are separate.
- No roles in the portal. There are releases onto objects, not bundles of permissions.
- The portal assistant sees only published, portal-released content — internal material and
drafts do not reach it.
- Portal content is phrased to be white-label ready, because it can appear under any brand.