Secure Client Portal

A Secure Client Portal Designed for Sensitive Work

Encryption in transit and at rest, role-based access, project-scoped permissions, magic-link authentication and full audit logs — without making the portal painful to use.

Start free See pricing

Service businesses that handle sensitive client data — accountants, lawyers, mortgage brokers, IFAs, healthcare providers, consultants with NDAs — cannot run on email and Google Drive forever. Eventually a client asks a security question that has no good answer, a regulator probes a data process, an incident reveals a folder shared too widely, or a partner refuses to send sensitive documents over email. That is the point at which a secure client portal stops being a nice-to-have and becomes a requirement.

The challenge is that "secure" and "usable" usually pull in opposite directions. Lock the portal down hard and clients abandon it because it is too painful. Make it convenient and you create attack surface. A good secure client portal threads that needle: strong defaults, simple client-side authentication, granular permissions for sensitive cases and an audit trail that satisfies the compliance question without slowing the work down.

HaloTasker is engineered with that balance in mind. This page covers the security stack, the access model, the audit and compliance posture and the practical implications for service businesses that handle regulated or sensitive client data.

Why a secure portal beats email and shared folders

Email and shared cloud folders are insecure by default for client work. Email is plaintext between mail servers, attachments are easy to forward to the wrong person, and once a document is in someone's inbox you have lost control of it. Shared folders are easy to over-share, hard to audit and rarely have project-scoped permissions. Both leave you with no real record of who accessed what, when.

A secure client portal centralises sensitive data in one controlled environment. Access requires authentication. Permissions are scoped per project and per role. Every view, download and signature is logged. Sharing is intentional, not accidental. Revocation is one click, not a frantic email chain. The compliance answer to "where does our client data live and who can see it?" becomes a single sentence instead of a paragraph of caveats.

Encrypted transport (TLS) on every connection
Encrypted storage of files at rest
Role-based access control across internal users
Project-scoped access for client users — one client never sees another's data
Magic-link authentication with configurable session expiry
Full audit log of every action, viewable and exportable

The HaloTasker security stack

Security is implemented in depth, not as a single feature. The core stack covers transport, storage, authentication, authorisation and audit.

Transport and storage encryption

All traffic to the portal uses TLS. All files and database content are encrypted at rest. Internal service-to-service traffic uses authenticated, encrypted channels.

Authentication

Clients authenticate by magic link to their email address by default, with optional persistent token mechanisms for low-friction repeated access. Internal team members can use email-and-password with optional SSO/SAML on enterprise plans.

Authorisation

Permissions are role-based for internal users and project-scoped for client users. Roles are configurable — admin, member, billing-only, view-only — and have granular sub-permissions for sensitive areas like quoting and settings. Cross-tenant isolation is enforced at the database level via row-level security.

Audit logging

Every meaningful action is logged: file views, downloads, signatures, quote acceptances, invoice payments, permission changes, user invitations. Logs are searchable and exportable for compliance reviews.

Data residency and deletion

Configurable data residency for enterprise customers. Deletion requests are honoured within published SLAs. Soft deletion with a retention window prevents accidental data loss.

Designed for regulated industries

Accountants, law firms, mortgage brokers, IFAs and healthcare providers face specific regulatory regimes — GDPR in the UK and EU, HIPAA in US healthcare, SOC2 expectations for enterprise clients, FCA expectations for UK financial services and so on. HaloTasker is engineered to support those regimes with a combination of technical controls (encryption, RBAC, audit) and process controls (consent management, data subject access workflow, breach response).

The product is GDPR-compliant by default, with data processing agreements available, configurable retention and a clear data export and deletion process. Enterprise customers can request additional documentation for procurement reviews.

Sensitive document workflows

For documents that carry particular sensitivity — KYC packs, signed engagement letters, tax returns, medical records, legal case files — the portal supports per-document permissions, restricted preview, watermarking and download tracking. Combined with the audit log, this gives you a defensible answer to any "who accessed this file?" question.

Security without sacrificing usability

The hardest part of secure portal design is keeping clients on it. The temptation to email a quick document instead of using the portal is what defeats most secure-portal rollouts. HaloTasker counters that by making the portal experience faster and easier than the email alternative: magic-link logins remove password friction, mobile-first design makes signing and uploading fast, and notifications nudge the client to act where they are most likely to act — their phone. Security goes up and friction goes down at the same time.

Use cases for a secure client portal

Any business that handles sensitive client data benefits, but the value compounds for regulated and high-trust industries.

Accounting and tax firms handling personal financial data
Law firms managing case files and engagement letters
Mortgage brokers and IFAs collecting KYC and supporting documents
Healthcare providers exchanging clinical records under HIPAA
Consultancies operating under client NDAs
Enterprise services teams whose clients require security questionnaires

Key benefits

Replace insecure email attachments with a controlled portal
Project-scoped permissions prevent accidental cross-client exposure
Full audit log answers compliance and incident-review questions
Magic-link auth removes password reuse risk
Encryption in transit and at rest as a default, not an upgrade
GDPR-compliant by default with DPAs available

Built for

Accounting and tax firms
Law firms and legal practices
Mortgage brokers and IFAs
Healthcare service providers
Consultancies under enterprise NDAs
Any business needing an answer to a procurement security review

Frequently Asked Questions

Answers from real users and experts

Is the client portal GDPR-compliant?

Yes. HaloTasker is GDPR-compliant by default, with data processing agreements available for enterprise customers, configurable retention windows and a clear process for data subject access, export and deletion.

How is client data encrypted?

All traffic uses TLS in transit. All files and database content are encrypted at rest. Internal service-to-service traffic is authenticated and encrypted.

How do clients authenticate?

Clients authenticate by magic-link emails by default, removing password reuse risk. Persistent token mechanisms provide low-friction repeated access without compromising security.

Can one client ever see another client's data?

No. Permissions are project-scoped at the database level using row-level security. Cross-tenant isolation is enforced by the platform, not by application logic alone.

Do you have audit logs?

Yes. Every meaningful action — file views, downloads, signatures, quote acceptances, invoice payments, permission changes — is logged. Logs are searchable and exportable.

Do you offer SSO/SAML for internal team members?

Yes, on enterprise plans. Internal team SSO with major identity providers is supported.

Can I configure data retention and deletion?

Yes. Retention windows are configurable. Soft deletion with a retention window prevents accidental loss; hard deletion can be triggered on data subject request.

Do you have a DPA?

Yes. A standard Data Processing Agreement is available for any customer who needs to sign one. Bespoke agreements are supported for enterprise customers.

Give sensitive client work the secure home it deserves

Stop emailing documents and start using a secure, audited, encrypted portal that your clients will actually log into.

Start free View pricing