Customer portals for small business: a practical UK guide

A portal is worth considering when customers repeatedly ask where to send something, your team cannot easily see what is outstanding, or the same paperwork gets requested across several emails.

It is less compelling when you only exchange an occasional file and your existing tools already handle that reliably. Look at a typical customer job. Where does it stall?

An accountant waiting for records needs clear requests for the right reporting period. A design studio collecting a brief needs structured answers and somewhere to keep supporting files. A heating firm preparing a visit may need photos, access information and agreed terms.

Those are different workflows, even though each could use a customer portal. Your public website can continue attracting enquiries and explaining your services. The portal handles customer-specific information after someone starts working with you. They are complementary; you do not necessarily need to rebuild one to add the other.

A customer portal can serve several purposes. Start with the workflows you need to support, then check which features are available.

These needs can overlap. Prioritise the workflow that costs you the most time, then check which capabilities are available today and what your plan includes.

For specialist processes, write down the requirement clearly. “We want our logo on it” is different from “our customers need access to a specialist ordering process linked to three internal systems”.

Ask how configuration, integration updates and support are handled, and include any ongoing work in your cost comparison.

If your main problem is customer paperwork, ask to see a complete request—from invitation to review—not just an attractive dashboard.

The distinction between received and checked matters. An uploaded file might be the wrong document, an unreadable photo or a statement from the wrong period. A portal that records a successful upload has confirmed delivery. It has not necessarily confirmed that you have what you need to start work.

Keep optional features tied to a real requirement. A forum, chatbot or extensive analytics dashboard may be useful for some businesses, but none compensates for a confusing upload process. Our secure document upload workflow shows how a named request moves through upload and review.

There is no single pricing model. Check whether the subscription is charged per business, staff member, customer or storage tier. Ask for the cost of your actual setup: your team, expected customer numbers, typical files and any required integrations.

Also account for:

• Setting up forms, checklists and permissions.
• Moving information from existing systems.
• Helping customers who struggle to sign in.
• Maintaining templates and reviewing submissions.
• Additional storage, branding or domain requirements.
• Exporting information if you leave.

For a concrete UK example, PORTALD’s published Solo plan is £25 + VAT a month, with up to 100 customers and 500 MB of storage. Practice is £75 + VAT a month, with up to 1,000 customers and 5 GB. A custom domain requires an active paid Practice or Enterprise plan. The trial lasts 14 days and does not require a payment card. Prices and limits checked on 31 October 2026; see current plans and limits.

Work out whether the time saving justifies the cost

Suppose your business handles 40 customer jobs each month. Each needs two follow-ups, taking four minutes apiece:

40 jobs × 2 follow-ups × 4 minutes = 320 minutes of chasing a month.

Assume:

• Staff time has an internal cost of £24 an hour.
• The subscription costs £25 a month.
• Running the portal takes another 20 minutes a month: £8 of staff time.
• Initial setup takes two hours: £48, spread across 12 months at £4 a month.

Your monthly comparison cost is therefore £37.

Under these assumptions, you need to remove roughly 93 minutes of chasing each month to break even. Include any VAT you cannot reclaim in your own calculation.

Released time is not automatically a cash saving. Your wage bill may stay the same. The benefit could instead be extra capacity, fewer interruptions or less evening admin. Do not count every minute at your customer billing rate unless you can genuinely turn it into additional paid work.

A login screen and cloud hosting are not enough evidence of good security.

The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of businesses identified a cyber breach or attack in the preceding 12 months. That measures incidents across business systems, not specifically customer portals. Read the government research.

Check access and recovery

Get clear answers to these questions:

• Customer separation: How does the system prevent one customer seeing another’s records?
• Staff access: Can access be limited by role and removed when someone leaves?
• Authentication: Can you require multi-factor authentication, particularly for staff accounts?
• Files: How are uploads and stored documents protected? Are downloads private?
• Recovery: What backups exist, how is restoration tested and who handles an incident?
• Leaving: Can you obtain usable copies of files, answers and agreement records? What happens to remaining copies?

The NCSC’s cloud guidance specifically identifies authentication, MFA and managing access as people join or leave as matters to evaluate. See the NCSC’s identity and authentication guidance.

For access testing, use dummy customer accounts and documents. Do not experiment with another customer’s genuine information. Our security and access controls page explains PORTALD’s approach.

Check your responsibilities under UK GDPR

Your business will usually be the controller for customer information where it decides why and how that information is used. A provider processing it only on your instructions acts as a processor. Outsourcing the software does not remove your responsibilities. The ICO explains these roles.

Where you use a processor, you need a written contract covering the required data-processing terms. Check security responsibilities, subprocessors, assistance with individuals’ rights and what happens to personal data when the contract ends. See the ICO’s contract requirements.

Before collecting documents, decide what you need, why you need it and how you will explain that to customers. Avoid requesting identification simply because the software allows it. The ICO’s small-business assessment provides a useful starting point.

Set retention periods appropriate to the records. UK GDPR does not impose one universal period for every customer document; other legal obligations may affect what you must retain. Read the ICO’s storage advice.

A UK-operated supplier is not necessarily using exclusively UK-based servers, backups or support providers. Ask which organisations can process or access information and how applicable international-transfer requirements are handled. The ICO explains when transfer rules apply.

Treat AI document checks as assistance, not verification

An AI check can help flag a date, missing detail or unreadable page. It should not be confused with confirming that a document is genuine.

PORTALD’s optional AI document checks provide an initial assessment against your instructions. They can be wrong, cannot verify identity or consult an external register, and do not replace your decision.

If you enable AI processing, understand which files go to the provider and how they are handled. PORTALD’s privacy policy explains its automated document processing.

A trial should answer a business question, not just confirm that you can create an account.

1. 1Choose one workflow. Pick something repeatable, such as collecting the information needed before a job starts. Give one person responsibility for the trial.
2. 2Record your baseline. Review several recent, comparable jobs. Note follow-ups, staff time and where customers got stuck.
3. 3Complete a dummy run. Test the customer and staff views, an unsuitable upload, a password reset and relevant access controls. Establish how you would retrieve your information.
4. 4Invite a small group. Once data handling is understood, use the workflow with a few suitable customers. Explain what the portal is for and where to get help.
5. 5Measure the whole process. Record completion by the agreed deadline, follow-ups per job, staff minutes per customer, login-help time and elapsed time until everything is ready.
6. 6Decide from the result. Keep it if the process becomes clearer or less costly overall. Change the setup—or stop—if you have simply moved the work somewhere else.

Count time spent supporting customers as well as time saved chasing them.

If your normal workflow takes a month, a short trial cannot prove a full month’s benefit. It can still establish whether customers can complete the process and whether your team can manage the result.

For the setup itself, follow our guide to onboarding a new client online.

PORTALD’s client portal for small business helps you organise the paperwork handover between your business and its customers.

You create a branded portal, prepare forms and document requests, add agreements and bring them together in a customer checklist. Customers use their browser; your team reviews what arrives and sees what remains outstanding. You do not need a developer or changes to your existing website. Explore the customer onboarding portal.

Reminders are not sent on an automatic schedule. You decide when to follow up.

Start with the workflow you need to improve now. Check the current features and plan details against your requirements before committing.

Already using Xero? The Xero customer invoice portal lets customers view their own invoices and download PDFs. It does not create invoices or take payments.

Research checked on 31 October 2026. Product details describe the service available on that date. The cost example is illustrative, not a measured customer result.

• UK government: Cyber Security Breaches Survey 2025/2026 — the dated, business-wide incident statistic, not a claim about portal effectiveness.
• NCSC: Identity and authentication — authentication, MFA and account-lifecycle considerations.
• ICO: Controller–processor contract requirements — contract terms, security responsibilities, subprocessors and end-of-contract handling.
• ICO: Small-business assessment — collection purposes, privacy information and practical accountability.
• ICO: Data storage advice — retention decisions.
• ICO: Restricted transfers — supplier identity, access arrangements and server location.

Some ICO pages flag guidance as under review following legislative changes. This guide links to the current published guidance and avoids making detailed claims about changing automated-decision rules.

Choose the request you regularly have to chase. Put it on a checklist, invite a customer and assess the complete process.

No payment card is needed, and you choose whether to subscribe.