Security & permissions

Your clients trust you with their business. PortalTable gives you the controls to be worthy of it — row-level scoping, role-based permissions, secure sign-in, and a full audit trail.

Per-client data scoping

Scoping is the rule that guarantees a client only ever sees their own records. Every portal is bound to a scope value; PortalTable filters every block by it before a single row reaches the browser. There's no client-side filtering to bypass.

Audit scope before going live

The most important pre-launch check is confirming a portal's scope value matches exactly one client. Use Preview as client and verify you see only their records. A wrong scope is the one mistake that crosses client data.

Roles and permissions

Decide what each client and teammate can see and do, down to the block. A client contact might view Projects and Invoices but only act on Approvals; a junior teammate might manage delivery without touching billing.

Owner: Full control of the workspace, billing, and connections. Usually the agency principal.
Team: Manages clients, projects, and delivery. Configurable access to billing and connections.
Client contact: Signs in to one portal. Sees only mapped, scoped data — never the console.

Authentication

Clients sign in with magic links — a one-time link to their email — or SSO where you've set it up. There are no shared base links to leak and no passwords for clients to reuse. Sessions expire on a schedule you control.

Encrypted connections

Airtable tokens are encrypted at rest and in transit; portals read only the scopes you grant.

Audit logs

Every approval, edit, and login is recorded — a clear trail for you and your clients.

Pre-launch checklist

Before flipping a portal to Live, run through these:

1
Scope verified
Preview as client shows only that client's records — nothing from another account.
2
Fields mapped tight
No internal fields (margins, rates, private notes) are mapped into any visible block.
3
Roles set
Client contacts have the right block access; no client can reach billing or the console.
4
Domain secured
Custom domain resolves over HTTPS with a verified certificate.

PortalTable offers EU and US hosting; pick a region per workspace. Your Airtable base stays wherever Airtable hosts it — PortalTable caches a scoped copy in your chosen region.

SOC 2 is in progress. The platform is GDPR-ready, encrypts data at rest, and supports a DPA for agencies that need one.

Yes. Remove a contact or pause the portal and their next request is rejected immediately — sessions don't outlive a revoke.

Billing & plans

Audit logs and SSO by plan.

How PortalTable works

Revisit the architecture.