Platform · front office

Customer portals that read from the ledger, not a copy of it

Most portals are a separate application fed by a sync, which means what your customer sees is yesterday's version of the truth. Ours reads the same records your finance team does, through a permission boundary you define — so the invoice they are looking at is the invoice.

See a portal on your data

Your size, your ledger, and what your customers need to do. We will stand up a working portal on a sample.

1 / 3
Your branding and domainPayments apply automaticallySSO or magic-link sign-in
your customersigned inpermission boundaryexposed, scoped to themOpen invoices & statementsread + payPayment history & receiptsreadProject status & milestonesreadApprovals & sign-offactDocuments & deliverablesread + uploadSupport requestsactnever reachableGeneral ledgerCost & marginOther customersVendor recordsPayrollInternal notesone data model · portal reads the same records your team does

What it does

The six things customers actually log in for.

Portals fail when they are built as a brochure with a login. These are the functions that produce repeat visits, and each one removes a piece of manual work from your side as well as theirs.

Invoices and statements

Open items, ageing, and downloadable statements, live from the ledger rather than a nightly export. When you post a credit memo, they see it immediately.

Pay online

Card, ACH, or bank transfer against one invoice or a selection. Payments apply to the right open items automatically and the cash posts without a person keying it.

Approvals and sign-off

Quotes, change orders, milestones, and timesheets approved in the portal with a recorded identity and timestamp — which is the evidence you need when a scope dispute arrives.

Project and order status

Where the work is, what is next, what is waiting on them. The single biggest reduction in inbound "just checking in" email we see.

Documents both ways

Deliverables, contracts, and reports out; W-9s, purchase orders, and source files in. Versioned, permissioned, and attached to the right record rather than lost in a thread.

Requests and tickets

A structured intake that lands against the customer and the project, so support volume becomes data you can look at rather than a shared inbox.

The permission boundary is the whole product

A customer portal is an outside party reading from the system that holds your general ledger, your margins, your other customers, and your payroll. Everything about how it is built should follow from that sentence.

The common architecture in this category is a second application with its own database, fed by a sync from the ERP. It is popular because it feels safer — the outside world never touches the real system — and it introduces two problems in exchange. The data your customer sees is stale by however long the sync interval is, which produces the phone call about a payment that cleared on Tuesday and still shows outstanding on Thursday. And you now have a second copy of customer financial data with its own access control, its own backups, and its own breach surface.

We take the other approach. The portal reads the same records, and the boundary is enforced in the query layer rather than by copying data somewhere less sensitive. A portal session is scoped to exactly one customer and cannot express a query that reaches beyond it — not by URL manipulation, not by an API call, not by an export.

A sync makes the data safe by making it old. A permission boundary makes it safe by making it unreachable.Same result for the attacker, very different result for your customer.

What that looks like in practice

  • Scoped by construction. Every portal query carries the customer scope, and the data layer rejects an unscoped read rather than trusting the caller to filter.
  • Field-level exposure. An invoice has a total, and it also has a cost and a margin. The portal sees the first and cannot request the others, at any level of the API.
  • Roles inside the customer. Their AP clerk pays; their project sponsor approves; their executive reads. You define which of your contacts gets which, and they can manage it themselves.
  • Everything is logged. Views, downloads, approvals, and payments land in the same audit trail as internal activity, which matters the day someone disputes having approved a change order.
  • Revocation is instant. Access ends the moment you end it, because there is no second system holding a copy that keeps working.

Sign-in without another password

Portals die from friction at the front door. We support magic-link email sign-in, which covers most small-business customers, and SAML or OIDC single sign-on for enterprise customers who require it. Sessions are short by default, and payment actions can be configured to re-authenticate regardless of session age.

Where this earns its keep

The measurable return is usually in two places. Days sales outstanding falls when customers can see and pay an invoice without emailing to ask for a copy — the improvement is typically a few days, and it is the cheapest DSO reduction available to most firms. And inbound status email drops sharply once project and order state is visible, which is time your delivery team gets back rather than a line on a P&L.

When the standard portal is not enough

This is where a lot of our engagement work comes from, and it is a genuine strength rather than a footnote. The standard portal covers invoices, payments, approvals, projects, documents, and requests. Plenty of businesses need something beyond that: a distributor whose customers need to reorder from a personalised catalogue, an MSP whose clients need an asset register, a construction firm whose owners need draw schedules with lien waivers attached.

We build those as custom modules on the same data model and the same permission boundary, hosted and versioned by us rather than handed over as a codebase you then own the maintenance of. The build is quoted at a published rate with a monthly hosting fee, which is how a bespoke portal stays a product rather than becoming a bespoke liability.

A limit worth stating

This is a portal, not an ecommerce storefront. If you need a catalogue with public browsing, cart abandonment, promotions, and consumer checkout, use Shopify and let us integrate it. We are good at authenticated, account-scoped experiences for known customers — that is a different problem.

Who uses it

Different customers, same six functions.

Agencies & consultancies

Clients approve scope and see burn against retainer without a status call.

MSPs & IT services

Ticket intake, asset lists, and monthly true-ups in one place.

Construction & trades

Draw schedules, lien waivers, change orders, and progress photos.

Distribution

Order status, backorders, reorder history, and self-serve reprints.

Professional services

Engagement documents, invoices, and secure exchange of sensitive files.

Any AR team

Self-serve payment and statement access, which is where DSO actually moves.

Questions

What people ask first.

Can we use our own domain and branding?
Yes. Custom domain, your logo, your colours and typography, and your terms of service. The portal should look like part of your business, not like a vendor tool your customers have to trust separately.
Does it work if our ledger is still QuickBooks?
Yes. The portal reads invoices, payments, and documents through the business graph, so it works whether your books sit in QuickBooks, NetSuite, Sage Intacct, Acumatica, Dynamics, Odoo, or Xero.
How do payments actually settle?
Through Stripe or your existing processor. The payment applies to the specific open invoices the customer selected, posts cash to the ledger, and updates their statement — with no manual application step on your side.
Can a customer see other customers?
No, and not because of a filter someone remembered to write. A portal session is scoped to one customer in the data layer, and an unscoped query is rejected rather than executed. That is enforced below the API, so it holds for every endpoint including exports.
What if we need something the standard portal does not do?
We build it as a custom module on the same data model and permission boundary — a reorder catalogue, an asset register, a draw schedule. Published build rate plus monthly hosting, versioned and maintained by us.
How long does it take to launch?
A standard portal on connected data is typically live in two to three weeks. Custom modules are scoped after a diagnostic and usually add three to six weeks depending on complexity.

Stop emailing invoices and status updates.

See a working portal on a sample of your own customers before you commit to anything.