Custom Software · 5 min read
How to Build a Client Portal for a Service Business
A client emails a document, a staff member files it and updates the CRM, and the client calls the next day to check that it arrived. A client portal can connect those steps. Here is how I would scope the first release, using an example from the advisor portal I built for the Consumer Protection Forum.
By David Amagid ·
What the first release needs
Pick one request type. Let the client open a request, upload a document, and see the next step. Give staff a place to receive the request, review the document, and update its status. Decide who can access each record and which system owns it.
Map one request from intake to completion
Take a real request and find where the client waits, where staff reenter information, and who follows up when a document is missing. Give each step an owner, an action, and a status the client can understand.
For example, in a service onboarding flow, the client fills in a form and uploads a document. Staff review it and approve it or ask for a replacement. The portal shows whether the file is under review, what is missing, and who needs to act.
Decide what each person can access
Write down which records and actions each role needs. Clients can see their own requests and documents. Staff work on assigned requests. A manager can reassign work and manage access when needed.
Enforce access on the server every time someone opens a record, downloads a document, or changes a status. In the pilot, sign in as one client and try opening a link to another client’s file. The server should deny the request.
OWASP guidance on authorizationDesign what happens after a document is uploaded
Attach each upload to its request and show the client whether the file arrived or needs replacing. Set allowed file types and size limits, validate them on the server, and keep files in private storage with access controls.
Test what happens when the connection drops during an upload. Let the client retry without creating another request and give staff a way to identify which version of the document arrived.
OWASP guidance on file uploadsDecide which system owns each record
Choose the source of truth for each field. The CRM can keep the client’s contact details while the portal owns the documents and their review status. Store a shared identifier so both systems can refer to the same request.
Start with one sync, such as creating a CRM review task after a client submits a request. Test what happens when that update fails or runs again. Staff should see the pending update, and a retry should update the existing task without creating a duplicate.
What I built for the Consumer Protection Forum
At the Forum, staff manage contact history and cases in a central workspace. I built a separate portal where advisors can find the cases assigned to them. Inside a case, they can review documents and recordings, add notes, and update the status.
The Forum portal serves advisors. A client portal can use the same separation between an external user and staff. Clients see their documents, the status meant for them, and the next step. Staff keep internal notes and assignments in their own workspace.
Read the Forum case management case studyPilot the portal with a client and a staff member
Run a representative request from submission to completion with someone acting as the client and a staff member handling it. Also test a missing document, a rejected upload, and a failed CRM sync. Decide who handles each issue before adding more request types.
- Track how many requests arrive with all required documents.
- Check how often staff reenter information the client already supplied.
- Count requests for status updates that the portal already shows.
Client portal development questions
Can a client portal work with our existing CRM?
Yes, if the CRM gives you access to the data the portal needs. Check which fields need to be read or updated, which system owns them, and what happens when a sync fails.
What affects the cost of building a client portal?
Request types, user roles, access rules, document handling, integrations, and data migration all affect scope. Mapping one complete request gives you a basis for a quote.