How your clients' access to the portal is protected

The Client portal lets people outside your company view, download or approve documents without having a WorkOS user. This is what protects them.

Access with a code by email

To get in, the person types their email and receives a 6-digit code:

• It expires after 10 minutes, can only be used once and allows 5 attempts.
• It's only stored as an encrypted fingerprint, just like the app sign-in code.
• There's a limit on code requests to slow down automated attempts.

Once verified, the session lasts 24 hours. After that they have to request a new code.

They only see what's theirs

Getting into the portal doesn't give access to everything. Each document is checked on every visit: WorkOS checks whether that email is authorized for that specific document (because it's a CRM contact linked directly to the document, or linked to the document's project). If they stop being linked, they lose access even if they still have the session open.

Approvals on record

When someone approves or signs a document, WorkOS stores who did it and when, together with the details the approval form asks for. That way there's a record of the approval.

What you decide

• Who you share each document with, by linking or unlinking contacts from the document or its project.

See also the article “Who can see each document in the portal”.