Sharing attachments with the client (the lock)

Every attachment on a task, project, company, contact or document has a lock. By default it is locked: only your team can see it. When you unlock it, the contact can download it from their client portal.

New attachments are always created locked, including ones you upload after unlocking others.

Who can unlock or lock

Task: its owner and whoever manages the account (the Owner and anyone with Technical administration permissions).
Project: its lead and whoever manages the account.
Document: its owner and whoever manages the account. Also on documents that are already signed: the lock only decides what the client sees, it does not change what was signed.
Company and contact: the Owner and anyone with Technical administration permissions.

If you cannot change it, you will only see the lock icon (not clickable) on attachments that are already unlocked.

How to unlock one

Open the record and go to Attachments.
Click the file's lock. You will be asked to confirm: Share this file with the client?
The lock turns green and open. To lock it again, click it once more (locking does not ask for confirmation).

What the client sees

In their portal, under Attachments, they only see unlocked files from the items that belong to them, grouped like this:

Projects and services: those of the projects linked to their contact record and those of the tasks in those projects (with the task name).
Documents: those of the documents shared with them.
General: those of their own contact record and of their companies.

On a document page in the portal, only unlocked attachments are shown too.

When it cannot be unlocked, or it locks itself

Private items are never shared. A private project or document cannot have unlocked attachments; as soon as you mark it private, all the locks of its attachments (and those of that project's tasks) are closed. Even if a private document is shared with the portal, its attachments do not appear under Attachments.
Two files with the same name in the same item cannot be unlocked: rename one first.
When a file is deleted, or the item is archived, the lock is closed.
When you rename an unlocked file it stays unlocked under the new name.
Files that reached a project, company or contact from email or messaging are never shared with the client (because of Google's data policy): their lock appears disabled and cannot be unlocked. Files already stored on a record before this rule cannot be told apart from the rest: do not unlock a file you know came from an email.

Who can enter the portal

Any CRM contact with a linked project or company can sign in with their email and a code. Inside, they only see what belongs to them, which may be nothing.