A secure portal for clients, with no client login.

Two different things get called secure

Search for secure client portal software and almost everything you find means the same thing by the word: your client gets an account, and the work sits behind their login. That is one way to restrict access. It is not the only one, and it carries a cost the category rarely prices in.

The complaint you hear from agencies and practices is never that the portal lacked a feature. It is that they set it up and the client never used it. Clients default to email unless the portal is the only way to get something they need, which is why the category’s own published advice is to put something they cannot get elsewhere behind the login, so they are forced in. That is a workaround for a design problem, and the design problem is the login. A gate you pass once is the same restriction with the adoption step removed.

The layers, in the order they do work

Security here is not one switch. It is a small stack, and it is worth knowing which layer is carrying the weight for you.

• An unguessable address, as the base. Every page gets a token URL with roughly 128 bits of entropy. It is never listed, never enumerated, has no sitemap entry, and sits behind a robots.txt that disallows the whole token namespace with the major AI crawlers named individually, plus a noindex header on every response, so search engines and AI crawlers that honour those directives leave it alone. Nobody arrives by browsing or by searching. This layer is on every plan, free included.
• A passcode on the client’s space. Set one gate on the space and every page served for that client inherits it. The passcode is stored as a PBKDF2-SHA256 hash with a per-entry salt, never in plaintext, so there is no plaintext for us to leak or for a support agent to read back to somebody. The prompt is a styled page on your own domain with no Stacktree branding, rather than the browser’s credential dialog. Solo and up.
• A company-email gate, when a shared secret is not enough. Instead of a passcode, require that the viewer verify an address on a domain you name, by magic link. Access then depends on controlling a mailbox at the client, not on holding a string that can be pasted into a chat. This is the stronger of the two gates and the right choice when it matters which person inside the client opens the work. Solo and up.
• A page-level override. A page can carry its own gate, which takes precedence over the space one. Use it for the one document in the engagement that should be tighter than the rest, without splitting the client across two addresses.
• An end date. Any page can carry an expiry, from minutes to never, or be set to burn after a single read. Expired and deleted pages are purged from object storage and the database within the hour. Free pages are capped at seven days; paid pages can be permanent or as short as you like.
• End-to-end encryption, for the rare page that warrants it. Encrypt in your browser before upload, with the key living only in the URL fragment, which browsers never send to a server. We store ciphertext we cannot read.
• A strict policy on the page itself. Hosted pages are served under a strict Content-Security-Policy, with a per-page hash allowlist computed at upload so your own inline scripts run and injected ones do not. One hosted page cannot be turned into a vector against another.

Once the client has passed the gate, their browser holds the grant for 30 days across the whole space. Changing or clearing the passcode invalidates the grants that the old code earned, so revoking access does not mean waiting a month.

What secure means here, and what it does not

The word is doing a lot of work in this category, so here is the honest boundary. Being precise about it is more useful to you than another paragraph of reassurance.

• It does not mean audited. Stacktree has not completed a third-party SOC 2 audit or a published external penetration test. The SOC 2 and ISO 27001 coverage in the stack belongs to Cloudflare, for the infrastructure the service runs on. We will sign a DPA and complete a vendor questionnaire, and if your client’s policy needs an attestation we do not hold, the platform is source available and self-hostable on your own Cloudflare account.
• It does not mean we cannot read your pages. A normal page sits in object storage we operate, so technically we can, as with any host. The exception is an end-to-end encrypted page, where the key never reaches us.
• A passcode is a shared secret, with all that implies. It can be forwarded alongside the link, and if you email both together they live in the same inbox. Where that is the risk you care about, the company-email gate is the layer that answers it.
• A gate is not identity. A passcode proves someone was told the passcode. An email gate proves control of a mailbox on a domain, which is closer, but it is still domain granularity rather than a named person.
• Nothing stops a legitimate viewer copying what they see. No product in this category does, whatever the marketing implies. Someone who can read a page can screenshot it, save it, or retype it.
• It is delivery, not a workspace. Stacktree does not collect files from your client, hold documents for e-signature, invoice, take payment, or carry messaging, project management, or a CRM. If you need those, you need different software, and the next section says so plainly.

Setting one up

1. Publish a deliverable under a client. Pick the client when you publish, or pass client: "Acme" from an agent over MCP. The space is created on first use, so there is nothing to configure beforehand. Filing work under a client is free on every plan, including Free.
2. Point a subdomain at the space. Add acme.youragency.com and create the DNS record shown. Verify the parent domain once and add a single wildcard CNAME, and every later client hostname skips the DNS step entirely.
3. Switch the portal on. The portal generates itself from what you have published, newest first, and regenerates every time you publish again. Each deliverable keeps its own path underneath the address.
4. Set one gate for the whole space. A passcode, or the client’s email domain. Everything served under that address inherits it. Send the client the address once.

The mechanics of the address and the portal are covered properly on the client spaces page, and the DNS side on custom domains. If you want a passcode on a single page rather than a whole client area, that is password-protecting a page and it works the same way.

When portal software is the right answer

Some practices should buy the suite, and it is worth saying so on a page like this one. Copilot, SuiteDash, Clinked, Moxo, Zendo and the rest exist because a real workflow needs them. Three signs that workflow is yours:

• Files move in both directions on a schedule, the client uploading records and you returning work.
• Signatures, approvals, or contracts have to happen in the same place as the documents.
• Invoicing and payment sit inside the engagement rather than beside it.

If two of those describe your practice, buy the suite without guilt, and note that most of them price per seat or per client, so the bill tracks your client list rather than your usage. Plenty of firms run both: the suite for the paperwork, a client space for the work itself. We have written the comparison out honestly on the client portal alternative page.

What it costs

Free, $0. Three pages in total, counted for the life of the account, each expiring after seven days, on an unguessable link. No passcodes, no email gates, no viewer numbers, and a small “Made with Stacktree” footer. Filing pages under a client is free here too. It is enough to see the flow, and it is not a place to keep client work.

Solo, $19 a month. The gate, and one client’s own address. Passcodes and email-domain gates, 25 pages live at a time with no expiry, one custom domain, one activated client space, opens and unique viewers, and nothing of ours on the page.

Studio, $79 a month. A client area for the whole book. Ten activated client spaces, ten custom domains, unlimited pages, and engagement analytics: time on page, scroll depth, and where attention landed. A space counts as activated once it has a hostname bound or its portal switched on, and archiving one gives the slot back. Space hostnames do not consume your custom-domain slots.

Firm, $249 a month. Unlimited client spaces, 25 custom domains, 1 GB a page, and uncapped publishing.

Applying your own brand across every page, and adding team members with roles, are both being built and are not available yet. Clients are never seats on any plan. The full table is on the pricing page.