Every business that exchanges documents with clients eventually has the same conversation. Someone cannot find the file. It was attached to an email in March, or possibly April, from an address that person no longer uses, and the version they eventually find is not the one that was signed.
That is the moment a client portal starts to look sensible. Usually it is also the moment someone suggests Dropbox and the problem gets deferred for another year.
Here is when a portal is genuinely worth building, when it is not, and what a realistic one looks like for a UK small business.
What a client portal actually is
Strip away the marketing and a client portal is one thing: a place your client logs into to do something specific with you.
The something matters more than the login. A portal without a defined job is a folder with a password, and folders with passwords do not get used. The portals that work are built around a repeating interaction that is currently happening badly over email.
Common ones, in rough order of how often they justify the build:
- Document exchange. Client uploads, you download, both sides can see what was sent and when.
- Job or case status. The client checks progress themselves rather than emailing to ask.
- Approvals and sign-off. Proofs, quotes, drawings, specifications. Approved with a click and a timestamp, not a “yes that looks fine” buried in a reply chain.
- Invoices and payment history. Everything owed, everything paid, downloadable.
- Data collection. Structured forms that go into your system rather than a PDF someone has to retype.
The three signals that you have outgrown email
Most small businesses do not need a portal. The ones that do usually show all three of the following at once.
The same document changes hands more than twice. One attachment each way is fine. A quote that goes out, comes back marked up, goes out again revised, and needs a final signed copy is four exchanges, and by the fourth nobody is certain which version is live.
More than one person on the client side is involved. Email threads fracture the moment a second person is copied in late. The portal’s real advantage over email is not security, it is that there is one canonical place, and it does not matter who joined the conversation when.
You are asked for the same information repeatedly. “Where are we up to?” is a question that costs a small business more hours than any other. If you are answering it several times a week, you are running a status portal manually, over the phone, for free.
If only one of those is true, better email discipline is cheaper and faster. If all three are true, the portal usually pays for itself inside a year, mostly in time rather than in anything you can put on an invoice.
The quarterly filing effect
Something changed for a large group of UK small businesses this year, and it is quietly pushing more of them toward portals.
Making Tax Digital for Income Tax became mandatory in April 2026 for sole traders and landlords over the qualifying income threshold, with the threshold stepping down in later years. HMRC’s guidance on whether and when you need to use MTD for Income Tax ↗ sets out who is in and from when.
The practical consequence is not the filing. It is that a document exchange which used to happen once a year now happens four times a year, plus a final declaration. Any process that was tolerable annually becomes genuinely irritating quarterly, and the businesses feeling this hardest are accountants, bookkeepers and letting agents dealing with dozens of clients at once.
We covered the mechanics in our guides to MTD for Income Tax for sole traders and MTD for Income Tax for landlords. The portal question is the operational consequence of both.
Why Dropbox is not the answer, and when it is
Shared drives get suggested first because they are free and already installed. They are the right answer for a genuinely small number of cases and the wrong one for most.
| Shared drive or cloud folder | Client portal | |
|---|---|---|
| Setup cost | Effectively nothing | Real project cost |
| Access control | Folder level, easy to get wrong | Per client, enforced by design |
| Audit trail | Limited and rarely usable | Who did what, when, retrievable |
| Status visibility | None | The main point |
| Client experience | Depends on their tools | Consistent, branded, one link |
| Scales to 50 clients | Badly | Yes |
Use a shared folder when you have a handful of long-standing clients, you already trust the arrangement, and the documents are not sensitive. Move to a portal when you have enough clients that folder permissions are a job someone has to remember to do, because that is the point at which they stop being done correctly.
The data protection argument, stated honestly
Portals get sold on security. The argument is real but it is usually overstated, so it is worth being precise about it.
Email attachments are not inherently insecure. What they are is uncontrolled. Once a document is in someone’s inbox, you cannot withdraw it, you cannot see who forwarded it, and you have no reliable record of what was sent to whom. When something goes wrong, that absence of a record is the actual problem.
Under UK GDPR you need appropriate technical and organisational measures for the personal data you hold, and the ICO’s guide to data security ↗ is the reference point. A portal makes several of those measures easier to demonstrate: access control per user, revocation when a relationship ends, and a log of who accessed what.
That is a compliance advantage, not a magic one. A badly built portal with weak authentication is worse than a well managed email process.
What a realistic build includes
The portals that get used are unglamorous. A first version that earns its keep usually contains:
- Login with proper authentication. Email and password with two factor, or a magic link. Not a shared password per company.
- A client record that mirrors your own system. If the portal has its own separate list of clients, you now have two lists and they will diverge.
- Upload and download with versioning. Every file keeps its history. This alone solves the “which version is signed” problem.
- A status field the client can see. One field, honestly maintained, removes most of the chasing emails.
- Notifications that are not noise. An email when something needs their action, nothing when it does not.
- An audit log. Boring until the day you need it, then the most valuable thing in the build.
What to leave out of version one: messaging, dashboards, document editing, and anything resembling a chat feature. Every one of those is a request that arrives during the project and every one of them is better served by something the client already uses.
What it costs, roughly
A portal is a modest custom software project rather than a large one. The variable is not the portal, it is the integration behind it.
- A standalone portal, with its own user list and file storage, is the cheapest and the least useful, because someone has to keep it in step with your real system by hand.
- A portal wired into your existing system, so clients, jobs and invoices come from one place, costs more and is the version that actually reduces work.
- A portal wired into a system you cannot access, because the vendor has no API, is the expensive case, and it is worth checking before you plan anything.
That last point is the one that catches people out. Check what your current software will let you read and write before you scope a portal, not after. Our guide to writing a brief for custom software covers what to establish before you ask anyone for a price, and the cost of owning custom software covers the part that continues after launch.
The failure mode nobody warns you about
Portals fail for one reason far more often than any other: the client will not use it.
If logging in is harder than replying to an email, they will reply to the email. Every time. The portal then becomes a second place where some of the information lives, which is strictly worse than having one imperfect place.
Three things prevent this.
- Make the link do the work. A notification email should contain a link that takes them straight to the thing that needs their attention, already logged in where that can be done safely.
- Stop accepting the alternative. If you keep taking documents by email, the portal is optional, and optional systems are unused systems. Pick a date and move.
- Give them something they want. Status visibility and invoice history are things clients actually value. Document upload is something you value. A portal that only does the second one is a chore you have outsourced to your customer.
When not to build one
Be honest about these.
- You have fewer than about ten active clients and the relationships are stable.
- The exchange is genuinely one document, once, in one direction.
- Your clients are not comfortable with logins and you have no appetite to support them through it.
- You would be building it because a competitor has one, rather than because a specific process is failing.
In all four cases, spend the money elsewhere. A portal is a good investment in a business that is drowning in repeated exchanges. It is an expensive ornament in one that is not.
Frequently asked questions
What is the difference between a client portal and a customer account area?
Mostly the direction of travel. A customer account area is usually self-service for things the customer does alone, such as viewing orders or changing details. A client portal is for a working relationship where both sides contribute: documents move in both directions and there is a shared state, such as a job or a case, that both parties care about.
Can I just use a shared folder with a password?
For a handful of trusted clients, yes. It breaks down when you have enough clients that permissions become an administrative task, when you need to prove who accessed what, or when a client relationship ends and access has to be cleanly withdrawn.
How long does a client portal take to build?
For a focused first version wired into an existing system, think in terms of weeks rather than months. The timeline is driven almost entirely by how accessible your current data is. If your existing software has a usable API, it is a short project. If it does not, that becomes the project.
Do I need one for GDPR compliance?
No. There is no requirement to have a portal. What UK GDPR requires is appropriate security for the personal data you hold, and there is more than one way to achieve that. A portal makes access control and audit trails easier to demonstrate, which is a genuine benefit, but a disciplined email process with encryption where needed is also defensible.
Will my clients actually use it?
Only if it is easier than emailing you, and only if you stop accepting email as an alternative. Portals that are introduced alongside the old process almost always fail. Portals that replace it, with a clear cut-over date and a link in every notification, are used within a fortnight.
Should the portal be part of my website or separate?
Separate, on a subdomain, in almost every case. It keeps the marketing site simple, it lets the portal have its own security posture and release cycle, and it avoids the situation where a website change takes down the thing your clients use to do business with you.
Start with the exchange that hurts most
Do not scope a portal by listing everything it could do. List the exchanges that currently go wrong, pick the one that costs the most time, and build for that.
Almost every good portal we have built started as a fix for a single irritating loop and grew from there. Almost every bad one started as a feature list.
If you are weighing this up and want a straight answer on whether it is worth it for your setup, get in touch and we will tell you if the answer is no.