19 JUL 2026

A web agency’s client portal: what you should demand

A web agency client portal: project stages, approvals with history and the six signs of a transparent vendor

“Where are we with the website?” If answering that means digging through three e-mail threads, a WhatsApp screenshot and a PDF called final-v3-REV, the problem isn’t you: it’s the vendor who left you without tools. In 2026 a client portal — one place where the project is visible: the current stage, who needs to approve what, the files, the invoices — isn’t a big-agency luxury; it’s the bare minimum of transparency a web agency owes you. In this article: the six signs that tell a real client portal from a shop window, the three security questions to ask before signing, and why none of this should cost you an extra euro.

The invisible project (and the disputes it breeds).

Most conflicts between client and agency aren’t born from the quality of the work: they’re born from memory. “You approved the big logo” — “no, we asked to make it smaller”. Without a record, every decision lives in someone’s head, and the most confident version wins over the true one. It’s not a character flaw, it’s a structural one: e-mail and chat are conversation channels, not archives of decisions. The Project Management Institute has been repeating it for years in its reports: ineffective communication is among the top causes of project failure — and a three-week web project is no exception.

There’s a quieter cost too: waiting. Every “where are we?” is an interruption for the people working and uncertainty for the people waiting; over a one-month project that’s dozens of messages that produce nothing. Transparency isn’t courtesy — it’s infrastructure: when the project’s status is visible, the question disappears on its own.

The six signs of a web agency client portal built for real.

Here they are, in order of importance. None of the six is exotic technology: they’ve been standard practice for anyone running projects for twenty years. The difference is who carries the burden: a serious vendor gives them to you as standard, not as a paid “premium module”. And if they show you the client portal at the first meeting, before you even ask, that’s a good sign: they have nothing to hide about how they work.

aVisible stages: the project has explicit stages — brief, design, development, content, review, launch — and you can see which one it’s in today, not as of the last phone call.

bApprovals with history: drafts and copy get approved or sent back with a comment, and it stays on record — who, what, when.

cFiles in one place: drafts, deliverables and materials don’t travel as 20 MB attachments — they live where you’ll find them a year from now.

dInvoices with status: number, amount, due date and payment status — without having to ask “could you resend it?”.

eTracked requests: every question opens a thread with its answer, not a chain that dies in the inbox of a colleague on holiday.

fYour language: if your team works across countries, the interface should follow you — not force everyone into technical Italian.

The six signs of a serious client portal: visible stages, approvals with history, files, invoices, tracked requests and a multilingual interface — The six signs, in order of importance: visible stages, approvals with history, files in one place, invoices with status, tracked requests, an interface in your language. None of the six is exotic technology: it’s discipline made visible.

The three security questions, before you sign.

First question: how do you get in? The best answer is “without a password”: a single-use link by e-mail that expires in minutes. NIST’s digital identity guidelines have been saying for years what everyone’s experience confirms — passwords get forgotten, reused and stolen. A single-use login removes the problem at the root instead of offloading it onto you.

Second: where does the data live? Names, e-mails, invoices and drafts of your website are business data. The GDPR requires minimisation — collecting only what’s necessary — and it’s squarely in your interest that it stays on servers in the European Union, where the regulation applies without contractual acrobatics.

Third: who sees what? In a portal serving several clients, data separation isn’t a detail: ask explicitly whether each client sees only their own projects and whether logins are recorded. A serious vendor answers in thirty seconds; an improvised one changes the subject.

Bonus, before you even talk to the agency: look at their own website with the same yardstick Google would use. Trust signals — who’s behind it, real contact details, published policies — take one minute to measure.

Measure a website’s trust signals: the free E-E-A-T tool →

A client portal doesn’t replace the contract (it completes it).

Beware of the opposite misunderstanding: an elegant portal is not a guarantee. The delivery date lives in the contract, not in the interface; so does the fixed price. The client portal is where you see the contract being honoured — stage after stage, approval after approval. The two work together: everything in writing in the agreement, everything in the open in the execution. Be wary of anyone offering only one of the two.

If you’re comparing quotes these days, we’ve written a guide on how to read them without surprises: the line items that must be there, the ones that are always missing, and the questions to ask before signing.

Website quotes: how to read one without surprises →

How we do it (and why it doesn’t cost an extra euro).

Declaration of interest: this guide isn’t neutral, because we’ve built a client portal — for ourselves. We build web apps for clients and our portal runs on the same platform: 8 project stages always visible, approvals with history, files, invoices and requests, interface in Italian, English or Russian, passwordless access, data on servers in Germany. It’s included in every project, from a brochure site to an e-commerce store, because for us transparency isn’t a paid extra on a price list: it’s the cheapest way to work well.

The criterion holds even if you choose another agency: demand to see your project. If the answer is “we’ll keep you posted by e-mail”, you already know how it ends.

Inside our client area, screen by screen →

Business websites: what a project includes →

Sources.

The figures and claims in this article come from here. These are primary sources, not summaries: open them and check for yourself.

NIST SP 800-63B — Digital Identity GuidelinesThe National Institute of Standards and Technology guidelines on authentication and credentials: the technical basis of passwordless access.
Regulation (EU) 2016/679 — GDPR, official textArticle 5 sets out the data-minimisation and storage-limitation principles cited in this article.
PMI — Pulse of the ProfessionThe Project Management Institute’s report series, which for years has ranked ineffective communication among the top causes of project failure.

Inside our client area →