What a client should see in a form dashboard
Short answer: A client should see the submissions of the forms you explicitly shared, read-only, and nothing else: no other clients, no workspace settings, no billing. Access should be one revocable permission per form rather than a shared login.
Agencies usually start by emailing a spreadsheet. It works for one client and one form. By the fourth client it becomes a weekly copy, paste and accidental-recipient problem.
Three models, three failure modes
| Model | What breaks |
|---|---|
| Shared login | You cannot revoke one person, and every action looks like the same user. |
| CSV by email | The data lives in inboxes forever, outside any retention or deletion policy. |
| Per-form permission | Requires a real access model, which is exactly why it holds up. |
What the client portal should contain
- The forms shared with them, and only those.
- Read access to submissions, with the timestamp and values.
- A clear empty state before their first form is shared.
- No editing, no deleting, no invitations: one owner of the data.
Read-only is not a limitation to apologise for. It keeps one person responsible for lead status, which is what prevents two people from marking the same lead contacted and losing track of it.
Why the permission must be a row
A link with a token is easy to build and hard to control: it gets forwarded, bookmarked and pasted into a group chat. A permission row ties access to an authenticated account, so revoking it takes effect immediately, including for a session that is already open.
permission(id, form_id, client_user_id, granted_at, revoked_at)
revoked_at IS NULL -> access granted now
revoked_at IS SET -> access gone, row kept for historyOnboarding a client in practice
- 1Create the form and confirm it receives a real submission.
- 2Invite the client by the address they actually use, not a guess.
- 3Let the invitation link create their account; do not send them through developer signup.
- 4Ask them to open the portal and confirm they see the form.
- 5When the engagement ends, revoke the permission instead of deleting the account.
What to keep for yourself
Notifications, status changes, exports and the ability to invite further viewers stay with the workspace owner. That split lets you hand over visibility without handing over control.