A client portal with no account

Four doors, one page

A client enters the portal through one of four doors the studio issues. A code door is a code the client types on the portal's front page. A link door is a URL that carries its own token. A phone door sends a one-time code by SMS to the number the studio gave it. An email door sends the one-time code to an address. The studio picks the kind when it issues the door and gives it a label - the client's name, or one person at the client.

A code or a link can additionally demand a one-time code, so that holding the link is not enough to enter. The one-time code is six digits, lives for five minutes, allows five attempts, and can be resent after a minute.

The invitation is sent in the same step the door is minted: an email, an SMS, or both, in the client's language. A studio that prefers to hand the link over itself can issue the door without sending anything and copy the credential from that one response; it is not shown again afterwards.

Nothing to install

The portal is a web page. On a phone it is the same page, laid out for the screen. The player is the browser's own: a video element for a cut, an audio element for a mix, an image for a still, and a plain sentence for a file the browser cannot show. A caption track rides along when the cut has one.

The client's session renews itself in the background while the page is open. A refresh or a lost cookie on the same device is never a lockout; the same device always gets back in. The studio can cap the number of devices a door may use, from one to twenty, and a new device past the cap ends the oldest session rather than the client's own.

Hebrew and English are both first-class, right to left included, and the portal writes to the client in the language on their contact record.

The preview, not the master

What the client watches is a preview rendition made from the uploaded file, the same rendition the studio's own review room plays. The master file is never served on the preview path. Downloading the master is a separate permission on the door, and a door without it has no download link at all.

Until the rendition is ready the page says why, because three different waits deserve three different sentences: still loading, still being made, or held for a safety check. Held means the malware scan has not cleared the file yet; every upload is scanned, and a file that is not clean is not served in any form, not even as a preview.

The preview URL is signed and short-lived, and it is issued only for an item that is on the client's list. An id the client did not receive from the studio answers not found, the same as a stranger's id.

What the client sees

Only what was sent through that door. A project door shows one project; a client door shows that client's projects. There is no navigation into other projects, no client list, and no names of staff who are not involved.

Status is told in six plain words: intake, in progress, waiting for you, revising, delivered, on hold. Every internal stage collapses into one of the six, so the client can answer the only two questions they ever have - is it with you or with me, and is it finished - without reading the studio's stage names.

The page carries the studio's name, and the logo and colours the studio set on its branding screen. Around the player sit the notes thread, the approve and request changes buttons when the door may decide, an upload area for a brief or reference files when the door may upload, and a download area when it may download.

Security that stays out of the way

A link carries 256 random bits and is stored only as a hash, as is a code. There is no button to show a credential again; a lost one means a new door, which the studio sees as a revocation in its own list rather than as a secret the database was quietly holding.

Every refusal at the front door reads the same: a wrong code, a revoked one, an expired one and a code from another studio all get the same sentence, so a guesser learns nothing. Guessing is rate-limited per address, and the door is never locked by a failed attempt, so a stranger cannot lock the real client out. The real reason for a refusal is recorded for the studio only.

A door expires after 30 days by default; the studio can set up to 365 days or, explicitly, no expiry. Revocation is immediate. Every entry, denied entry, one-time code sent or failed, note, decision, upload and download is written to an append-only audit log, with the door and the session named.

• Credential stored as a hash; never shown twice.
• Uniform refusal at the door; the real reason is for the studio.
• 30-day default expiry; revoke in a second.

Clients are free on every plan

A client is not a seat. The number of doors a studio may issue is unlimited on every plan, including the free Trial. Tasked prices the studio's work - Starter at $29 a month, Professional at $99, Business at $249 - and never the people looking at it.

That is the point of a portal with no account: the person whose whole job is to say yes should not need a login, a password reset, or a line on the invoice.

Questions that keep coming up

Does the client need an app?

No. The portal is a web page that works on a phone or a desktop browser. Nothing is installed.

Can the client download the original file?

Only if the door has the download permission. The preview the client watches is a rendition; the master is served only through the download permission, and only when the file has passed the malware scan.

What happens when a link leaks?

Revoke it from the item; refusal is immediate. Issue a new door in the same minute. The studio's trail also shows how many distinct devices used the old one.

How long does a link last?

30 days by default. The studio can set 1 to 365 days, or explicitly choose no expiry.

Can we put our own logo on it?

Yes. The logo and colours set on the studio's branding screen appear on the client's page.

Is there a limit on how many clients we can invite?

No. Clients are free and unlimited on every plan; pricing is on the studio's work, not on who reviews it.