These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Client Collaboration Portal
- Features
- Portal branding and access
Portal branding and access
Create a recognizable client workspace with explicit access to each shared project. An active client role does not grant every project. Check the site, user and project grant together. Suspending a user or hiding a project must also close access through existing links.
OverviewActive portal sites×
Client Collaboration Portal · Portal branding and access
New
Active portal sites
Suspended waits for the portal manager
| Portal code | Name | Account | Subdomain slug | Custom domain | O auth provider | |
|---|---|---|---|---|---|---|
| CEDAR-PORTAL | Cedar Point property portal | Cedar Point Properties | cedar-point | portal.cedarpoint.example | None | |
| NORTHQUAY-PORTAL | North Quay offices portal | North Quay Workspaces | north-quay | projects.northquay.example | ||
| WILLOWGATE-PORTAL | Willowgate campus portal | Willowgate Estates | willowgate | portal.willowgate.example | Microsoft | |
| RIDGEVIEW-PORTAL | Ridgeview apartments portal | Ridgeview Living | ridgeview-living | clients.ridgeview.example | Okta | |
| HARBORLINE-PORTAL | Harborline retail portal | Harborline Retail Group | harborline | projects.harborline.example | One login |
6 of 6 records
CEDAR-PORTALPortal sites · PS-51957
NoneNameCedar Point property portal
AccountCedar Point Properties
Subdomain slugcedar-point
Custom domainportal.cedarpoint.example
Launched at23 Oct
What you can do
Brand and site setup
Admin configures the foundation: Brand themes (color palette, logo, typography defaults — one per customer brand or per delivery-team brand), email templates (per-event branded templates for invitation, document notification, approval request, decision callback, status update, comment notification, weekly digest, and inactive-user reminder), and the portal sites master (one row per Account tenant — portal code, Account, brand theme, subdomain slug, optional custom domain, O auth provider if SSO, magic link enabled, default email template, Owner Portal Manager). Brand changes that affect a live portal site flow through the MDM approval workflow with Admin sign-off; email templates preview-render against a fixture row before publish.
Project exposure
Portal Manager picks which internal Projects (read from Project Management) to expose on each portal site via the portal projects line items: snapshots the project name, sets display order, marks Status: Active. A Project hidden mid-engagement flips to Status: Hidden rather than being deleted, so historical document shares, approval requests, and client activities keep their referential anchor for audit.
Client user invitation
Portal Manager creates a client users row (full name, Email, portal site, Account, client role: Approver / Collaborator / Viewer) and grants per-project access via portal user access rows (one per portal project with access level: View / Comment / Approve). On Status: Invited set, the client-user-invite workflow fires via the configured record event. A configured workflow service provisions the OAuth / SSO entry when portal site O auth provider is set, generates a magic links row with Purpose: Invite setup and expires at: now + 7 days, and notification service delivers the branded invitation using the portal site’s themed email templates row. The client clicks the link, completes setup (password or SSO bind), and the magic-link auth handler flips client user status: Invited → Active and stamps activated at.
Keep the decision trail useful
An active client role does not grant every project. Check the site, user and project grant together. Suspending a user or hiding a project must also close access through existing links. Portal sites, portal projects and client users establish separate tenant and project boundaries. Bind each external login to client user principal ID; shared email addresses and Account text do not grant membership. Effective access is the intersection of active site, active client user, active portal project and active portal user access. The role and grant must both permit the action. Every list, export, attachment, notification and direct API request rechecks this scope; hiding a card is insufficient. Magic link token stores only a one-way hash of a high-entropy token. Tokens are purpose, recipient, project, target and expiry bound, redeemed atomically once, and revoked on access removal. Opening an email link displays a confirmation page; link previews and GET requests cannot approve a decision. Approval action requires a verified session and an explicit confirmation POST with expected request revision. Tokens and signatures never appear in analytics, application logs or audit exports.
What your team sees
- Active portal sites — Review active branded sites and their configured access context.
What it keeps track of
Data model- Portal sites
- The branded site config — one row per Account or Project tenant on the portal. Resolves the subdomain or vanity domain, the brand theme, the OAuth provider, and the active status. Every portal URL hits one portal site first.
- Brand themes
- Reusable theme presets — color palette, typography, and logo defaults — applied across one or many portal sites. Centralizes brand updates so a customer-rebrand does not require touching every site row.
- Email templates
- Per-event branded email templates — invitation, document notification, approval request, status update, comment notification, inactive-user reminder, weekly digest. Subject + Body interpolate portal site + client user + payload variables at send time. Email templates are looked up by
(PortalSite, EventType)at workflow runtime; if no portal site-specific template exists for the event, the system falls back to portal site default email template. - Client users
- The external client user master — every person on the customer side who logs into the portal. Two-namespace separation from internal Users keeps the auth surfaces and audit logs clean.
- Portal projects
- Junction between portal sites and the internal Projects master — which Projects each portal site exposes to clients. One row per Project published on a Site.
- Portal user access
- Junction granting a client user visibility into one or more portal projects on a portal site. The portal-scope access pattern reads this table on every page render.
- Magic links
- One-click email-to-portal tokens. Issued for invitation, document view, approval action, status-update view, and digest opens. Single-use, time-limited, server-side resolved — Token never appears in any UI.
Who uses it
Permissions- Admin
- Configures branding and identity.
- Portal Manager
- Invites clients and maintains project grants. client roles use only their granted scope.
Set up Client Collaboration Portal your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.