Your clients call or email for the status of their case or annual accounts. Someone looks it up, replies, and does the same again tomorrow. A client portal solves that by giving clients access themselves. This guide answers: when does a portal pay off, what does it cost, and how do you avoid starting over in two years? With five concrete examples from Dutch SMBs.
What is a client portal exactly?
A client portal is a secured web environment where your clients log in to see their own data, share documents and handle tasks themselves. The difference with a SaaS dashboard: a dashboard is for your internal team, a portal is for the external user.
When does a client portal pay off for SMBs?
- Client management with repeat questions. From 50 active clients with at least 2 touchpoints per month.
- Billing and time tracking.
- Documents back and forth. From 100 documents per month.
- Support and self-service. 24/7 access to status or case file without calling someone.
- Personalised data per client.
Which examples exist? Five concrete use cases
Example 1: accounting firm, document portal
- What it does: clients upload receipts, bank statements and contracts. Annual accounts come back in the same place.
- Investment: €15,000 to €30,000 one-time, €200 to €450 per month.
- Stack: Next.js + Supabase Auth + storage + integration with Exact or Twinfield.
Example 2: property manager, tenant portal
- What it does: tenants see rent, annual settlement, maintenance requests. For Mastone we built a variant on this.
- Investment: €18,000 to €40,000 one-time, €350 to €700 per month.
Example 3: law firm, client portal
- What it does: clients view their case file, costs, scheduled hearings. Approach matches what we built for BBS Advocaten.
- Investment: €20,000 to €45,000 one-time, €400 to €800 per month.
Example 4: consultancy, portal for deliverables
- What it does: clients see deliverables, meeting notes, open action items. For Planit Consulting we built a variant on this.
- Investment: €15,000 to €32,000 one-time.
Example 5: e-commerce, B2B portal
- What it does: B2B clients see their own price list, order history, invoices. Order directly from the portal.
- Investment: €20,000 to €50,000 one-time.
What are the core components of a good client portal?
| Module | What it does | Typical investment |
|---|---|---|
| Authentication + MFA | Login, MFA, session management | €2,000 – €4,000 |
| Per-user dashboard | Personal overview | €2,500 – €5,000 |
| Documents | Upload, download, version control | €2,500 – €5,500 |
| Communication | Messages, audit trail | €2,000 – €4,500 |
| Notifications | Email, in-app, optional SMS | €1,500 – €3,000 |
| Settings + admin | Profile management, role-based access | €2,000 – €4,000 |
What does building a client portal cost?
| Scope | Modules | One-time investment | Delivery time | Monthly |
|---|---|---|---|---|
| Basic | Login, dashboard, documents | €8,000 – €18,000 | 2-3 weeks | €200 – €400 |
| Standard | Plus communication, notifications, integrations | €20,000 – €50,000 | 4-8 weeks | €400 – €700 |
| Extended | Plus multi-user, audit log, AI features | €50,000+ | 2-4 months | €700 – €1,400 |
Which phases do you go through?
- Discovery (1-2 weeks). Functional document, data model, fixed price.
- Design (1-2 weeks). Clickable prototypes in Figma.
- Build (2-10 weeks). Two-week sprints with a working version.
- Test (parallel + a few days). OWASP Top 10 security scan.
- Launch + onboarding. Monitoring, handover document, SLA.
Which pitfalls to avoid?
- Bringing in security too late. MFA and audit trail must be in the architecture from sprint 1.
- Not enforcing multi-tenancy properly at database level. Frontend-only filters can be bypassed within an hour.
- Underestimating onboarding. A portal where clients do not sign in is a dead portal.
- Testing performance only on live data. Run a load test before go-live.
- Scope creep during build. Work with a closed functional document.
Which security and GDPR requirements apply?
The Dutch Data Protection Authority expects appropriate measures under article 32 GDPR.
- Encryption in transit and at rest. TLS 1.2 or higher.
- MFA for every user. Not optional.
- Role-based access control.
- Audit logs for at least 12 months.
- EU hosting with Hetzner DE, AWS Frankfurt or Azure NL.
- Data processing agreement with every sub-processor.
How do you measure success after go-live?
- Adoption within 90 days. Below 60 percent is a red flag.
- Ticket reduction on front office. 25 to 50 percent reduction within 6 months.
- Customer satisfaction on portal experience. Short question inside the portal after each action.
Authentication: SSO, MFA and magic links, what fits when?
The login is the first touchpoint in your portal and determines whether clients continue or drop off. A password-only flow no longer meets GDPR expectations. The question is which combination of methods fits your client group. A law firm with corporate clients often picks different routes than a property manager with private tenants who log in only twice a year.
| Method | When to apply | Watch out for |
|---|---|---|
| Password + MFA via authenticator | Business clients with multiple logins per month | Mandatory MFA enrollment in first session |
| Magic link via email | Private users or rare logins | Email remains a single point of failure |
| SSO via Microsoft or Google | B2B clients with their own IT department | Configure per client tenant, costs one to three hours |
| Passkeys (WebAuthn) | New portals from 2026 onwards | Browser support is broad, mobile still mixed |
| Phone OTP | Sectors with low email adoption | SMS costs add up at high volumes |
Realtime features: chat, notifications and status updates
Clients expect a portal to update within seconds, not that they have to refresh manually. Realtime functionality sounds heavy, but with Supabase Realtime, Pusher or Ably it can be built within one sprint. The choice depends on the type of interaction and the expected volume. For most SMB portals Server-Sent Events beat WebSockets, because they are simpler to scale.
- Status updates on case or order. Light payload, polling every 30 seconds often suffices. Apply realtime from 200 concurrent users onwards.
- In-portal chat with your team. Requires persistent connection, read receipts and archiving for the audit trail. Budget €4,000 to €8,000 extra.
- Notifications for new documents or invoices. Combine in-app badge, email and optional push. Use a queue like BullMQ to handle outages.
- Live presence (who is viewing now). Often a gimmick. Only add this if clients collaborate on documents.
File handling: virus scanning, versioning and GDPR retention
Documents are usually the main function of a client portal, and at the same time the biggest legal exposure. An uploaded file can carry a virus, an earlier version can have legal value and retention periods are dictated per sector by law. Work with a clear file architecture from day one, otherwise you will rebuild this within a year.
- Virus scan on upload. ClamAV or a paid service like the VirusTotal API. Files in quarantine until the scan completes.
- Versioning per file. Keep at least the last three versions plus an audit record of who replaced what.
- Enforce retention periods automatically. Tax documents 7 years, medical data 15 or 20 years, HR files 2 years after exit.
- Signed URLs with short expiry. A maximum of 15 minutes for download links, otherwise they leak via screenshots or email forwards.
- Encryption at rest with client-specific keys. A hard requirement for law and healthcare, a sales argument for other sectors.
Mobile or desktop: native app or PWA for your client portal?
A native app sounds professional, but costs two to three times as much as a well-built Progressive Web App. For 90 percent of SMB portals a responsive PWA is the right call. Native only pays off if you actually need push notifications, offline functionality or camera integration. Start with PWA, measure whether clients ask for a native version, and build it only then.
| Criterion | PWA | Native iOS/Android |
|---|---|---|
| One-time investment | €0 extra on top of web | €25,000 – €60,000 extra |
| App Store distribution | No | Yes, with review cycles |
| Push notifications | iOS since 2023, Android fully | Fully on both platforms |
| Offline use | Limited via service worker | Full |
| Maintenance | One codebase | Three codebases (web + iOS + Android) |
| Camera and biometrics | Limited | Full |
Audit trail requirements per sector: what to record
The audit log is the quiet hero of every client portal. In a dispute, a data breach investigation or a disciplinary procedure this is the first place anyone looks. What you must record differs per sector. A lawyer has different obligations than a property manager. Do not underestimate this during the build, because retroactive logging is not possible.
- Law firms. Every document access, case mutation and communication. Retention 20 years per Dutch Bar (NOvA) guidelines.
- Accounting. Access to annual reports, tax filings and correspondence. At least 7 years per Dutch tax retention rules.
- Healthcare. Every access to a medical file including reason for access. 15 year retention per WGBO.
- Real estate. Rent mutations, maintenance tickets, payment history. 7 years per fiscal duty, 3 years for maintenance.
- HR and payroll. Access to payslips and employment contracts. 7 years fiscal, 2 years for personal data after exit.
White-label and multi-brand client portals
Some companies want to offer the portal under multiple brands. A franchise with regional labels, a holding with subsidiaries, or an agency reselling the same portal to its own clients. This is possible, provided you architect it correctly on day one. Adding multi-brand later typically costs 30 to 50 percent of the original build.
- Theme layer per tenant. Colours, logo, font and favicon configurable in admin.
- Own domain per brand. client.brandA.com and client.brandB.com point to the same codebase.
- Email sender per brand. Configure SPF and DKIM properly, otherwise mail ends up in spam.
- Legal copy per brand. Terms, privacy statement and cookie banner differ per label.
- Database isolation per tenant. Row-level security on tenant id, tested with automated penetration tests.
Client onboarding: launch plan for 3 to 4 weeks
A portal that works technically but where clients never sign in is wasted money. Do not underestimate onboarding. Plan it as a project in itself, with a clear owner inside your team and a communication calendar. Our experience from TopDevs projects: companies that plan onboarding hit 70 to 85 percent adoption within 90 days, those who leave it to chance stall at 30 to 40 percent.
- Week minus 2: announcement email to top-20 clients. Personal, with a two-minute video showing what it solves.
- Week minus 1: webinar or short demo call. Optional, but lifts adoption by 25 percent.
- Week 1 of launch: phased rollout per 50 to 100 clients. Not everyone at once, otherwise your support drowns.
- Week 2: follow-up email to those who have not yet logged in. A one-to-one approach beats a mass email.
- Week 3 to 4: feedback call with 5 active users. Ship the top-3 improvements right away, clients see their input matters.
Integration with billing and email tools
A portal rarely stands alone. Clients expect invoices, emails and CRM data to sync automatically. Good integrations save your team hours per week and prevent errors. Bad integrations break with every API update and cost more upkeep than they return. Start with the two most important integrations, add the rest only after go-live.
| Tool category | Examples | Typical build time |
|---|---|---|
| Accounting | Exact Online, Twinfield, Moneybird, e-Boekhouden | €2,500 – €5,000 per integration |
| Payments | Stripe, Mollie, Adyen | €1,500 – €3,500 per integration |
| CRM | HubSpot, Pipedrive, Salesforce | €3,000 – €6,000 per integration |
| Transactional email | Postmark, Resend, SendGrid | €500 – €1,500 setup |
| Marketing email | Mailchimp, ActiveCampaign, Klaviyo | €1,500 – €3,000 per integration |
| DocuSign or similar | DocuSign, SignRequest, Eversign | €2,000 – €4,500 per integration |
TopDevs case study: portal for a professional services firm
A Dutch professional services firm with around 180 active clients came to us with a familiar story. Their front office handled an average of 40 calls per week with status questions, document requests and invoice copies. Two staff members spent together roughly two-thirds of their time on these repeating questions. We built a Standard portal in 6 weeks for around €28,000 one-time.
- Scope: login with MFA, dashboard per client, document upload with versioning, invoice archive, in-portal messages, integration with their accounting tool.
- Result after 6 months: 78 percent client adoption, phone volume down by 55 percent.
- Time saved: about 32 hours per week freed at the front office, redirected to client advice instead of admin.
- Payback period: roughly 9 months based on saved hours at internal cost rates.
- Lessons learned: the first two weeks of onboarding were decisive, after that adoption grew organically.
How do you start concretely?
- Step 1: write down in 30 minutes what clients ask most often right now. Top 5 questions go into module 1.
- Step 2: pick a first client segment of 50 to 200 users.
- Step 3: schedule a paid discovery of 1 to 2 weeks.
Plan a free intake call. Our way of working sits in our terms and conditions, portals fall under custom platforms.
