Buyer guide
Custom portal vs off-the-shelf
Ollie Turner, a tax partner at Verallo Advisory, says the firm abandoned its OneClick portal for personal tax. Uploading questionnaires for clients in bulk was too manual, so staff emailed each client a bespoke request. They could not see whether anyone had opened it. Clients replied in pieces, and many preferred email. The portal existed. The work had moved back to the inbox.
Written by SiteMivo. That account is a Glasscubes-sponsored piece on AccountingWEB, and it is about information requests, not a sign-off workflow. Drafted with research assistance.
Buy it when a configured product already finishes the job
Invite a client, receive a file, answer a question, take a payment. Then do it again with a revised file and a second contact. If that sequence already works in software you pay for, a custom build is a second system to maintain. A logo on someone else’s portal is not a reason to commission one.
Build it when the exception is the work
Financial Cents surveyed 261 bookkeeping and accounting professionals in early 2026. Spreadsheets were the second-most common tool sitting beside the official stack. The pattern is familiar even when the percentage is not a law: the product covers the standard path, and the awkward 20% lives in a sheet, an inbox, and one person who knows the workaround. Own that 20% only if it is the thing clients are paying you for.
Permissions are the other reason. In 2021, Power Apps portals with an OData feed and table permissions left off exposed about 38 million records across 47 organisations to anonymous readers. Microsoft called it configuration, not a vulnerability. That is not “a logged-in client opened another client’s folder.” It is the failure mode you still have to test: one organisation must not read another’s records by changing an id.
Accept it by removing a permission with the tab still open
A menu that disappears is not the test. Retry the same action, and retry a saved link, after the role is gone. The server has to refuse it. Microsoft’s continuous access evaluation can revoke a session on a critical event within about fifteen minutes. It does not, by itself, prove your folder permission changed. You still run that test on your own roles.
Client portals start from the workflow, not a feature list. If you are not sure you need a portal at all, read website vs portal vs SaaS.