Answer the question before they email it.
For firms and service businesses whose staff spend hours answering 'where's my…' emails and chasing documents and approvals. We build secure portals where customers see status, exchange documents, approve work, book and pay, connected to the systems your team already uses. Customers get answers at any hour, and your people get their time back.
Signs you need this
If two or more of these sound familiar, there's likely time and money to recover.
Status emails fill the inbox
Customers email and call to ask where things are up to. Each enquiry interrupts someone doing billable or productive work.
Documents travel as attachments
Sensitive files go back and forth by email, versions multiply and nobody is sure which is current. It is slow, and it is a privacy risk.
Approvals stall the work
Quotes, variations and sign-offs sit in someone's inbox. Work stops until a staff member notices and chases.
Payment depends on reminders
Invoices go out by email and staff chase late payers by phone. Cash flow depends on someone remembering to follow up.
What changes for the business
Fewer status enquiries
Customers see live status drawn from your job, matter or project system without waiting for a reply. Staff time moves from relaying updates to doing the work.
Documents in one secure place
Requests, uploads and downloads sit against the right job or matter, with version history and access controls. Less attachment-chasing, and less personal information sitting in inboxes.
Faster approvals
Quotes, variations and sign-offs are approved in the portal, with a record of who approved what and when. Work restarts sooner and disputes are easier to resolve.
Quicker payment
Customers pay invoices and deposits by card through Stripe, and payment status flows back to your accounting system. Card details go straight to Stripe rather than through your servers, and staff spend less time chasing.
Bookings without phone tag
Customers choose appointment or service times from real availability, with confirmations and reminders sent automatically. Fewer calls to coordinate, and fewer forgotten bookings.
A service customers notice
A clear place to see progress makes a firm or service business easier to deal with. That supports retention and referrals in a way scattered email updates cannot.
What we build
Secure sign-in and permissions
Multi-factor or passwordless sign-in, with roles for customers, their colleagues and your staff, so each person sees only what they should.
Status and progress views
Live job, matter, project or order status drawn from your internal systems, with milestones and next steps in plain language.
Document exchange
Document requests, uploads and downloads against the right record, with version history, expiry dates and an audit trail.
Approvals and forms
Quote and variation approvals, intake forms and checklists that write straight into your systems instead of an inbox.
Bookings and payments
Appointment and service booking from real availability, and invoice or deposit payments through Stripe.
Messaging and notifications
Secure messages tied to the record rather than scattered across inboxes, plus email or SMS alerts when something needs the customer's attention.
Technology we work with
- TypeScript
- Node.js
- PostgreSQL
- Cloudflare
- Stripe
- Microsoft 365
- Xero
- Practice and job management system APIs
- Email and SMS notification services
- REST APIs and webhooks
How it runs
Timings are indicative and depend on your systems, data and approvals.
Map the questions
We review a sample of inbound emails and calls to see what customers ask and what staff relay, then rank portal features by the staff time they would release.
1 to 2 weeks (indicative)
Design
Screens, permissions and integrations are designed, then tested with a handful of real customers and staff.
2 to 3 weeks (indicative)
Build and integrate
A staged build on our reusable sign-in, permissions and audit modules, connected to your practice, job or CRM system.
6 to 12 weeks (indicative)
Pilot and roll out
A pilot group of customers uses the portal first, then we roll out with invitations, help content and scripts for staff.
2 to 4 weeks (indicative)
Care and improve
Monitoring, security updates and support, plus new features based on what customers actually use.
Ongoing
Worked example
Accounting firm: a knowledge assistant staff can trust, and an end to the document chase
An illustrative 60-person accounting and advisory firm loses senior time to routine questions, has no rules for AI, and chases client documents by email. The system starts with an AI use policy, then gives staff an assistant grounded in the firm's own procedures, with citations and permissions, and moves document collection into a client portal.
- Job created in the practice management system
- Portal sends the client a document checklist
- Uploads filed against the job
- Staff prepare the work
- Knowledge assistant answers from approved sources, with citations
- Manager and partner review
- Client sees status in the portal
Guardrails, fit and measurement
Guardrails we apply
- Customers see only their own records, enforced in the database with PostgreSQL row security policies as well as in the application.
- Every sign-in, view, upload, download and approval is written to an audit log.
- Card payments use Stripe's low-risk integrations, which send payment details directly to Stripe without passing through your servers.
- Reasonable security steps in the spirit of APP 11 and the OAIC's guide to securing personal information: multi-factor sign-in, need-to-know staff access, encryption and a breach response plan that reflects the Notifiable Data Breaches scheme's 30-day assessment window.
- Designed and tested against WCAG 2.2 level AA, so customers using assistive technology can use the portal.
Not the right fit if
- Businesses with few customers or quick, simple transactions. If customers rarely ask for updates, a portal adds a login nobody uses.
- Organisations whose internal systems don't hold reliable status data. A portal shows what is in your systems, so we would fix the data first.
- Firms whose existing practice software includes a portal that fits. Configuring it properly is usually cheaper than building one.
What we measure
- Inbound status emails and calls per week
- Share of active customers signing in each month
- Median time from document request to receipt
- Approval turnaround for quotes and variations
- Days from invoice to payment for portal-paid invoices
- Staff hours released from relaying updates
Pricing
Client portals are scoped individually, usually after an Altitude Diagnostic or a fixed-scope discovery, so the first release is sized to the features that matter most.
Questions, answered.
How much does a client portal cost, and how is it scoped?
We scope each portal individually, usually after a Diagnostic or a fixed-scope discovery. Cost depends mainly on the features you need, the systems the portal reads from and writes to, and your security and permission requirements. Many portals start with status and documents, then add approvals, bookings and payments in later releases.
Is a portal secure enough for financial, legal or health information?
It can be, provided security is designed in rather than added later: multi-factor sign-in, permissions enforced in the database, encryption, audit logs and regular updates, checked against the OWASP Application Security Verification Standard. Health service providers are covered by the Privacy Act regardless of turnover, so health data needs particular care. We are technologists, not lawyers, so for regulated information we work alongside your legal or compliance adviser.
Will our customers actually use it?
They will if it answers their real questions faster than emailing you. That is why we design from a sample of actual enquiries, pilot with real customers and make the portal the first place status, documents and invoices appear. Staff scripts help redirect routine requests during rollout.
Can the portal connect to our practice management or job system?
Usually, through the system's API and webhooks, or through scheduled exports as a last resort. During discovery we check what your system supports, including rate limits and which records can be written back, before we commit to a design.
Who owns the portal and the data, and what if Altitude Creative disappears?
Your data and the code written for you are yours, held in accounts in your organisation's name. The portal is documented (architecture, data dictionary, deployment steps and runbooks) and built on mainstream technology so another developer can support it. Source-code escrow can be written into the agreement if you want extra protection.
Related services
- System integrationsConnect your CRM, Xero, job system and email so nobody re-keys data. APIs, webhooks and sync rules, plus monitoring that alerts you to failures first.
- Custom CRM developmentA CRM built around your pipeline, accounts, quoting and service history, with AI that drafts follow-ups and does the data entry. Owned by you, not rented.
- AI assistants & knowledge systemsRole-specific AI assistants that answer from your own documents, cite the source and respect permissions. Built on Microsoft 365, Google or a custom stack.
- Business process automationAutomate intake, quoting, follow-up, onboarding and reporting across the systems you already use. Measured in hours released, with people on exceptions.
Where this matters most
Find out what your customers keep asking
We'll review a sample of inbound enquiries and show which portal features would release the most staff time.
Sources
Third-party facts on this page, checked 14 October 2026.
- PostgreSQL 14 Documentation: Row Security Policies, The PostgreSQL Global Development Group. www.postgresql.org/docs/14/ddl-rowsecurity.html
- Integration security guide, Stripe Docs. docs.stripe.com/security/guide
- Chapter 11: APP 11 Security of personal information (APP guidelines), Office of the Australian Information Commissioner. www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information
- Guide to securing personal information, Office of the Australian Information Commissioner. www.oaic.gov.au/privacy/guidance-and-advice/guide-to-securing-personal-information
- Quick reference guide for responding to data breaches, Office of the Australian Information Commissioner. www.oaic.gov.au/privacy/notifiable-data-breaches/quick-reference-guide-for-responding-to-data-breaches
- Small business (Privacy Act coverage), Office of the Australian Information Commissioner. www.oaic.gov.au/privacy/privacy-for-organisations/small-business
- OWASP Application Security Verification Standard (ASVS), OWASP Foundation. owasp.org/www-project-asvs
- WCAG 2.2 is a W3C Recommendation, W3C Web Accessibility Initiative. www.w3.org/WAI/news/2023-10-05/wcag22rec