Broken access control is the number one risk in the OWASP Top 10 for 2025, and OWASP says 100% of the applications it tested had some form of it. A client portal is, at its heart, an access-control system with screens on top: every client must see their own documents, invoices and messages, and nobody else's. That one fact shapes the features, the build options and most of the cost.
This guide covers what a portal contains, the four ways to build one in 2026, what each costs to build and run, and how to decide. Prices come from vendor pricing pages read on 28 October 2026, build costs from Clutch and a published agency estimate, and the security points from OWASP and Supabase.
What a client portal actually has to do
The word covers anything from a page of shared files to a full self-service application. Most portals share the same six building blocks. What changes the price is how many of them you need and how strict the rules are inside each one.
| Building block | What clients do there | What makes it expensive |
|---|---|---|
| Sign-in and accounts | Log in, reset passwords, invite colleagues | Single sign-on, two-factor sign-in, several people per client company |
| Roles and permissions | See only their own company's data | Client hierarchies, per-project or per-field visibility |
| Documents and files | Download reports, upload signed papers | Large files, version history, virus scanning, retention rules |
| Requests and messages | Raise a request, follow its status | Approval steps, notifications, links to your help desk |
| Billing | View invoices, update a card, pay | Usage billing, several currencies, tax rules |
| Dashboards and data | See project status or account figures | Pulling live data from a CRM, ERP or accounting system |
Two blocks cost more than they look. Permissions: a client company with an owner, a finance contact and three project staff, each seeing different things, is a data-model decision that touches every screen. Integrations: live figures from your accounting system mean a connection that breaks when the other system changes.
Billing is the block people overbuild. Stripe's hosted customer portal already lets customers update billing information and payment methods, change or cancel subscriptions, and pay, download and view invoices. It is configured in the Stripe Dashboard and supports custom branding, so many portals only need to link to it. Its limits: it cannot sit inside an iframe, and usage-based or multi-product subscriptions can be cancelled there but not changed.
Our client portal adoption statistics cover the other half of the picture: who logs in once a portal exists, and what self-service resolves on its own. One number from that research is worth repeating here. A Gartner survey of 5,728 customers, reported by CX Today in August 2024, found that only 14% of service issues were fully resolved through self-service. A portal that only answers questions will not carry the load; one where clients pay, approve or upload usually earns its keep.
The four ways to build a client portal
The choice depends on how unusual your permission rules are, where your data has to live, and how many people log in.
| Route | Examples | Typical entry price | Ceiling |
|---|---|---|---|
| Portal product | Assembly, SuiteDash, Clinked | Monthly subscription | The vendor's permission model and branding tiers |
| No-code builder on your data | Softr, Noloco | Softr Basic $19 a month, Pro $99 | Rules you write yourself; user caps per plan |
| Webflow site plus membership layer | Webflow with Memberstack, Wized | Memberstack Basic $25 a month billed yearly | Front-end logic; data held across several services |
| Custom application | Next.js with Supabase and Stripe | Build cost first, then about $45 a month to host | Only your budget and your team |
Sources: Softr, Memberstack, Supabase and Vercel pricing pages, read 2026-10-28
Portal products. These are complete products: sign in, files, messages, invoices, branding. They are the cheapest route when your needs match the product. The trap is that branding and permissions sit on higher plans. Our forthcoming comparison, "Client Portal Software in 2026: 12 Options Compared on Permissions, Branding and Price", goes through the plans one by one.
No-code builders on your own data. Softr and Noloco put a portal interface on top of data you already hold in Airtable, a spreadsheet or a database. Softr's pricing page lists Basic at $19 a month with five team and five client users, and Pro at $99 a month with 10 team and 50 client users, Softr branding removed and granular permissions. Business, at $329 a month, adds two-factor sign-in and domain-restricted sign-up. This route suits teams whose data is already structured and whose rules fit a visual editor. The risk moves to you: a rule written wrongly shows the wrong rows, and the builder will not notice.
Webflow with a membership layer. Webflow used to offer native User Accounts. Its developer changelog states that as of 29 January 2026, User Accounts functionality has been disabled on all Webflow sites, and the related APIs were removed. A Webflow portal now means a membership tool such as Memberstack, often with Wized or custom code for the logic. Memberstack lists Basic at $29 a month, or $25 billed yearly, for 1,000 live members with a 4% transaction fee, and Professional at $49, or $39 yearly, for 5,000 members with a 2% fee. Our comparison of Wized and custom code explains where that stack runs out of room.
Custom application. A custom portal is a web application with its own database, sign-in and permission rules. We build applications in Next.js, so read this route with that bias in mind. It costs the most to build and the least per user to run, and it is the only route with no ceiling on rules, design or integrations.
What client portal development costs
A subscription costs nothing to build and something every month for ever. A custom portal costs a project budget up front, then a small hosting bill and yearly upkeep. Published data for portals specifically is thin; the two most useful figures are a general software benchmark and one agency's estimate.
| Figure | Value | Who published it and what it measures |
|---|---|---|
| Most common software project budget | $10,000 to $49,999 | Clutch, from projects reviewed on Clutch, updated September 2026 |
| Average software project cost | $132,480 | Clutch, same dataset, all project types |
| Most common hourly rate band | $25 to $49 an hour | Clutch, software development companies |
| Custom portal, essential scope | EUR 15,000 to EUR 22,000, 8 to 10 weeks | Kolonell, agency estimate, September 2026 |
| Custom portal, standard scope | EUR 22,000 to EUR 35,000, 10 to 14 weeks | Kolonell, agency estimate |
| Custom portal, advanced scope | EUR 35,000 to EUR 45,000, 14 to 16 weeks | Kolonell, agency estimate |
| Custom portal, heavy custom | EUR 45,000 to EUR 70,000, 16 to 24 weeks | Kolonell, agency estimate |
| Yearly upkeep | 15% to 20% of the build cost | Kolonell, agency estimate |
Source: Clutch software development pricing guide, 2026; Kolonell custom client portal cost guide, 2026
Read the Clutch figures as a proxy. They cover all software projects reviewed on Clutch, not portals, and the average is pulled up by large builds; the most common band is the better guide for a first portal. The Kolonell ranges come from an agency that sells portal builds and does not publish its method, so treat them as one firm's price list rather than a market survey.
What moves a quote inside those ranges is the building-block table above: each extra role level, live integration and billing rule beyond Stripe's hosted portal adds design, build and test time.
What a custom portal costs to run
Hosting is the small number. A portal with a few hundred client logins fits on entry paid plans.
| Service | Plan | Listed price | What is included |
|---|---|---|---|
| Supabase (database, sign-in, files) | Pro | From $25 a month | 100,000 monthly active users, 8 GB disk, 100 GB file storage |
| Vercel (hosting) | Pro | $20 a month per developer seat | Hobby is for personal, non-commercial use, so a business portal needs Pro |
| Clerk (optional sign-in service) | Hobby or Pro | Free, or $25 a month ($20 billed yearly) | 50,000 monthly retained users; 100 organisations included |
| Stripe customer portal | Hosted by Stripe | No portal fee listed; normal Stripe fees apply | Invoices, payment methods, subscription changes |
Sources: Supabase, Vercel, Clerk pricing pages and Stripe documentation, read 2026-10-28
Beyond the included amounts, Supabase charges $0.00325 per extra monthly active user and $0.0213 per extra GB of file storage. Clerk bills on retained users rather than active users, and its organisation features matter for portals: 100 organisations are included per app, then $1.00 each up to 1,000. If you sign in through Supabase alone, Clerk is not needed. Our MVP tech stack for 2026 explains how we choose between those parts, and our Supabase vs Firebase comparison covers why a relational database suits data with clients, projects and roles.
The real running cost is people: updates, broken integrations and new views, which is what the 15% to 20% upkeep figure covers.
The access-control work that makes a portal safe
This is the part buyers cannot see in a demo. OWASP lists 40 weaknesses under broken access control in its 2025 Top 10, from users reaching another account's records by changing an ID in a URL to missing checks on API calls.
On a Supabase stack, the main control is row level security. Supabase's documentation describes a policy as adding a WHERE clause to every query, and it is blunt about the default: a table in an exposed schema without row level security is readable and writable by any role with a grant on it. The fix is to enable it on every such table and write a policy for each one.
On a portal project, we would model the permission grid in the database first, then test it with fake client accounts before any screen is designed: one test per role, per table, for read and for write. We would also test the awkward cases: a user removed from a client company, and a staff member who covers several clients.
Our forthcoming "Client Portal Requirements Checklist: 40 Questions Across Users, Permissions, Documents and Billing" lists the questions to answer before a quote.
How to choose a build route
Start with the permission grid: every type of person who will log in, and what each may see and change. Test the routes against it in order of cost.
Choose a portal product when your grid is simple, your clients are one or two people each, and the product's branding tier is affordable for your client count.
Choose a no-code builder when your data is already structured, your team can maintain the rules, and the plan's user caps fit your client numbers.
Choose Webflow with a membership layer when the portal is a light extension of a marketing site, such as gated resources.
Choose a custom build when the portal is part of your product, your permission rules are unusual, data has to stay in a given region or database, or per-user pricing would cost more each year than running your own.
What this means for your client portal project
Most firms should start with a product or a builder, and many never need more. If you do build, budget for three things in this order: the permission model and its tests, the integrations, and the screens. Ask any developer how they will test that one client cannot see another's data; the answer tells you more than a portfolio. Our web apps service page explains how we scope a custom client portal.
