Client document portals

Stop chasing clients for paperwork

Your clients get a portal in your practice’s name. They upload, you see what is still outstanding, and the chasing stops.

  • Held in the EU
  • AES-256 encrypted
  • Access enforced in the database
YM
Your practice
Document portal
44%

4 of 9 accepted

Bank statementsAccepted
NHS pension statementIn review
Expenses summaryOutstanding
Take a photo

The problem

An inbox cannot tell you what is missing

Attachments, forwarded emails, photographs taken on a phone, arriving in no particular order. Who has been asked for what, and how long ago, lives in somebody’s memory.

So qualified staff spend the week on administration instead of accounting, and a deadline slips because one statement never came.

A portal that only holds files is a branded Dropbox, and it loses to the one your practice already pays for. Knowing what is missing, and who to ask, is a different product.

How it works

Three steps, and nothing sits in an inbox

01

Raise a checklist

Build the list of documents you need, with a deadline. Save it as a template and never retype those ten items again.

02

Your client uploads

They get an email, sign in with a six digit code, and send a statement from the phone in their hand. No password to forget, nothing to install.

03

Accept or send it back

Accept what is right. Send back what is not, with a reason, and it reappears on their list.

And chasing is one message, not forty. Your list opens on whoever is furthest behind, and a single note goes to everyone still outstanding. Each one is recorded, so you can prove you asked.

See it working

Security

Built for a practice that holds financial records

Most portals put every firm’s clients in one system and hand you a login. For a practice whose whole value is discretion with client money, that is the wrong shape. Yours is separate: your own deployment, your own domain, your own storage.

Your documents stay in the European Union

The database and the files themselves are held in Helsinki, Finland, on a server that runs your practice and nobody else. Encrypted backups go to Germany each night, where they cannot be deleted for 30 days. Not "our global network". Two named places, and we will show you.

Encrypted, and never on an open URL

Every file is encrypted with AES-256 as it is stored, using a key your portal holds and the storage provider does not keep, in private storage with public access switched off. There is no link to a document at all: each one is passed through your portal, which checks who is asking before it sends a byte.

Nobody gets in who you did not let in

Who may see and change what is enforced by the database itself, not by the login screen, so a bug in a page cannot widen it. Each colleague has a role that decides what they may change. Staff accounts are invite-only — a colleague cannot register themselves — and a client account exists only because your practice created it. Two-factor sign-in is supported and is enforced in the same place, by the database.

Every action recorded, and any tampering shows

Uploads, views, downloads, approvals, rejections, invitations and sign-ins are written to a log that nothing signed in can change or remove. Each entry is sealed to the one before it, and the whole record is checked every night, so an edit made from outside the application is found rather than hidden.

Data protection

When a client asks, you have an answer

Usually it is where their bank statements are kept and who can see them. You should have a better answer than “in my email”. Each of these is something you can say in that conversation and stand behind afterwards.

“Where are my documents actually kept?”
In encrypted storage in Helsinki, Finland, in the European Union, under a data processing agreement signed with your practice before anything goes live, setting out what is held, where, for how long, and on whose instructions.
“What happens if you stop using them?”
Your client records and every document are exported on request. If the practice leaves, the storage is emptied and closed rather than quietly retained.
“Can you tell me everything you hold on me?”
Precisely, and with dates. A subject access request is answered from the portal rather than by searching back through an inbox.
“And if something goes wrong?”
A documented process reports a breach within 72 hours, so your practice can meet its own notification duty without waiting on us to work out what happened.

For your clients

They will actually use it

A GP, a sole trader, a practice manager. They did not choose this software and they will not learn it. So there is nothing to learn.

  • No password. A code arrives by email and that is the whole sign in.
  • Photograph it there and then. A statement on the kitchen table goes straight up from the phone.
  • One list of what is still needed, outstanding first.
  • A rejection says what was wrong and what to send instead.
“He’s got a function where he’s then not having to chase people for information.”

The reason a practice buys this, in the words of the first one to ask for it.

Twenty minutes

See it with your own branding on it

Long enough for the whole thing: raising a checklist, a client uploading from their phone, and what you see the moment it lands.

No obligation, and nothing to install to see it.