A simple client portal
Give clients one place to log in, see status, and grab the latest file — without you in the loop.
What you'll have at the end
A branded, secure portal where each client only sees their own stuff. Status updates land automatically. File handoff stops happening over email. Your inbox calms down by Friday.
01
Who this is for
- Consultants, agencies, and solo operators who deliver work to multiple clients
- Service businesses (legal, accounting, design) tired of the 'where are we?' email
- Anyone who has accidentally sent Client A's file to Client B
02
How to frame the idea
A client portal is mostly an access-rules problem in a trench coat. The hard part isn't the screens — it's making absolutely sure Client A cannot see anything that belongs to Client B, ever, even by changing the URL. Get the rules right first, then everything else is just layout.
03
What people actually build
Project status portal
Each client sees: current phase, next milestone, last 5 updates, files. Nothing else.
Tax document handoff
Upload return drafts. Client reviews and signs. Audit trail shows who did what when.
Design review portal
Latest mocks, threaded comments, approval button. No more email zip bombs.
04
Tool choices, honestly
Lovable + Lovable Cloud
Single-app portal where you control branding and the data lives with you.
Cursor + Supabase
You want to handcraft row-level security rules and review them like a pro.
Notion / Linear shared views
You have 3 clients and a tolerant brand. Don't build software for problems duct tape solves.
05
Prompts you can lift
Design the access model
Design an access model for a client portal. Each user belongs to exactly one client organization. They can see projects, files, and updates only where the project's organization matches theirs. List the database tables, the user→org relationship, and the exact row-level security rules. Then tell me how I'd test the rules manually.
Build the file handoff
Add file upload + download. Files are scoped to a project. Only users in the project's organization can see or download. Generate signed, expiring URLs — never expose the raw storage path.
Add the audit trail
Every time someone views, downloads, comments, or approves something, log it with user id, action, target, timestamp. Show me a per-project audit view I can hand to a client if asked.
Save and reuse these prompts in PromptlyDo™ with your favorite AI.
- Install the PromptlyDo™ browser extension
- Sign in or create a free account
- Right-click any prompt above and save it to PromptlyDo™
06
What tends to break
- Hidden URL = secure. It isn't. Test by signing in as Client A and pasting Client B's URL.
- Magic-link emails that don't expire. A forwarded link should not be a permanent backdoor.
- File uploads with no virus check, no size limit, no type check. A client portal is also a clientele entry point.
- Sending notifications that reveal too much ("Acme Corp uploaded merger.pdf" → wrong inbox = wrong day).
07
What AI forgot to ask you
- Can a client have multiple users? Can one user belong to multiple clients (e.g. consultants)?
- What happens when someone leaves a client org — does access revoke immediately or end-of-day?
- Are files retained forever, or do they expire? Who decides?
- Are clients allowed to see each other's existence (e.g. comment mentions) or are they totally walled off?
08
Before real users see it
- Signed in as Client A: I cannot see Client B's projects, files, or even their names.
- Changing the URL to a Client B record returns a not-found, not a forbidden (don't leak existence).
- File downloads go through signed URLs that expire in under an hour.
- Removing a user from a client revokes session and access on next request — not next day.
- I have a per-client audit log I could send if compliance asked tomorrow.
09
Questions to sit with
- 1.What's the actual loss if Client A sees one of Client B's files for 30 seconds? That answer drives how paranoid the access model needs to be.
- 2.Do I want clients to comment, or only consume? Comments triple the surface area.
- 3.Self-serve onboarding (clients invite their own team) or admin-controlled?
Ready to app it?
Take this path into your tool of choice — and when you finish (or get stuck), share what you learned so the next builder doesn't reinvent it.