Your customers' doors — what people outside your company see
Every other guide describes screens your staff use. This one turns the picture around: we stand
where the customer stands and look at the pages they reach from outside — with no account
and no password — and why each one is built the way it is.
Our running example:Ahmed Mansour, purchasing manager at Nile Trading Co.
He is your customer, not your employee, and he will never open one of your internal screens. We
follow him receiving a quote, opening his portal, and raising a complaint.
1 — The big idea: six doors, each with a different key
People outside your organisation reach you through exactly six doors. Learn these and every
later question answers itself:
Customer portalYour customer signs in with their email and sees their quotes, cases and invoices.
Web formAnyone on the internet fills it in and becomes a lead.
Quote linkSent to one person, who accepts or declines from it.
Satisfaction surveySent automatically after you resolve a case.
Careers pageCandidates see your vacancies and apply.
UnsubscribeIn every marketing message — required by law.
What separates them is what the person is holding:
The link IS the authority
Quotes and surveys: whoever received the email is entitled to answer. No sign-in, and no reason for one.
Open to everyone
The form and the careers page: anyone at all. Which is why both carry bot traps and per-address rate limits.
A real session
The portal only. Your customer signs in with their email and gets a session — but does not become a user of your tenant and consumes no seat from your plan.
2 — The customer portal: signing in without a password
Ahmed opens the portal link and finds no password box. He enters his email and the system mails
him a one-time sign-in link. Why? Because he visits this twice a year — ask him for a password
and he will forget it, and every visit becomes a password reset. That step fails before it
starts.
The portal door. At the top is your logo, not the platform's — Ahmed believes
he is dealing with you, and he is entitled to keep believing it. A line at the bottom tells
employees this is not their door.
Notice the wording: "If this address is registered with us, a link is on its way" —
the same answer whether the address is known or not. Saying "no such account" would let anybody
test addresses and learn who your customers are.
Inside, Ahmed finds four tabs: Quotes (accept or decline), My requests (raise a
case and follow the replies), Invoices (to read), and My account (stop marketing
email, or close every session).
The same page on a phone — not a luxury: most links you email are opened on one.
3 — The web form: from the internet to a lead
This is the only door open to anyone. Whoever fills it in becomes a lead immediately, is assigned
to a rep by your assignment rules, and a task appears in that rep's work list.
The hosted form page. You define the fields and the page builds itself from them —
nobody has to write any code.
Something you cannot see in the picture: a hidden field known as the honeypot. A real
visitor never sees it; a bot that fills every input fills that one too — and we answer "thanks,
received" and store nothing. We do not tell it that it was caught, because that only teaches it
to avoid the trap next time.
4 — The quote link: agreeing without an account
When you send Ahmed a quote he receives a link. Opening it shows the whole quote — lines, prices,
total — with a field for his name and two buttons: Accept and Decline. There is no
sign-in, because the person who received the email is the person entitled to answer.
When he accepts, we record his name, the time, and the address the request came from
together. That is the closest thing to a signature a link can carry, and it is what gets quoted
if there is a dispute six months later.
And when a link has expired, been withdrawn, or been superseded — this is the page.
It explains and tells the customer what to do, rather than showing a blank screen or a
technical error.
That link is a credential: whoever holds it can accept. Do not copy it to anyone and do
not put it anywhere public. If you suspect it reached the wrong person, send a new quote — the
old link stops working by itself.
5 — Unsubscribe: the one page without your logo
Every marketing message must carry a stop link — that is a legal requirement, not a preference.
The page asks before it acts rather than unsubscribing on load, because mail clients and security
scanners follow links before a human sees them, and we would be unsubscribing people who never
clicked.
Note that this page carries no logo — deliberately, for the reason below.
Why no logo here specifically? This page answers identically whether the link is real or
tampered with. If we branded only the real ones, the presence of the logo would itself confirm a
valid link, and anyone could probe. A page without a logo is cheaper than a page that leaks.
Also: this stops marketing email only. A reply to a complaint or a quote confirmation still
reaches them, because stopping those would harm the person it was meant to protect.
6 — The careers page: the candidate's door
Same logic: a public page, carrying your logo, where a candidate applies without an account. Only
published vacancies appear — anything internal or still a draft is invisible from outside.
The careers page. In this shot nothing is published, and the page says so plainly —
the link works and the page is fine, there is simply nothing to show.
7 — The important question: could another company's customers see my data?
No. And that is not a promise — it is built in at three levels:
Every URL contains your tenant key. The same form name under a different key answers
"not found".
The database itself refuses. Even if code were wrong, a layer in the database filters
by organisation, so a query cannot return another tenant's rows at all.
Known and unknown answer alike. A wrong key gets the same response as a correct key
with no such record — so nobody can probe keys to learn who is on the platform.
And a commercial point: a customer signing into the portal consumes no seat from
your plan. A portal account is a different kind of account from an employee's, and its token is
refused by every internal screen.
8 — Recipes: "I want to…"
Give a customer access to the portal
From the contact's record → invite to portal. A sign-in link goes to their
email. No password is sent, and none is invented.
A customer says the sign-in link does not work
Sign-in links are single-use and short-lived, and any older one stops
working as soon as a new one is requested. Have them request a fresh link from the portal page
itself.
Check whether the customer opened the quote
Open the quote from the quotes screen — the first view and the view count
are recorded. "Never opened" and "opened four times and went quiet" are two very different sales
conversations.
Cut off a customer's portal access immediately
Portal users → suspend. You can also close all their sessions, so a device
left signed in is signed out.
Get our logo on all these pages
Upload the organisation logo once in the organisation settings — every
public page picks it up. There is no per-page setting.
9 — Frequently asked
Why no password for the portal? Isn't a password safer?
In practice, the opposite. A password for a site you visit twice a year is a password written on
paper or reused from somewhere else. A temporary link expires by itself, works once, and is tied
to an address you registered.
If somebody learns the portal URL, can they get in?
No. The portal address is a public page like any other. What opens the door is the link mailed to
a registered address — and if that address is not on your records, nothing is sent.
Does the customer see all of the company's customers?
They see what belongs to their own account. Their session is bound to one contact and one
account.
Can the portal live on our own domain?
Today the pages sit on the platform's address, carrying your logo, name and colours. A separate
domain is a different piece of work in the hosting layer — ask whoever runs the deployment.
Can customers pay invoices from the portal?
No — they are there to read. The platform issues invoices as documents and does not take money,
and a pay button that led nowhere would be worse than none.
In summary. People outside your organisation reach you through six doors — portal, form,
quote link, survey, careers page and unsubscribe — and all of them carry your brand rather than
the platform's, because your customer believes they are dealing with you and is entitled to keep
believing it. What separates them is what the person holds: a personal link, a door open to
everyone, or a real session that costs you no seat. For the addresses themselves, see
Your public links.
