{"id":1306,"slug":"research-brief-client-portals-smb-june-2026","title":"Research brief: client portals for SMBs — the honest case (June 2026)","kind":"reference","scope":"business","status":"current","audiences":["kevin","smb-owner","candid-team"],"topics":["agency-methodology","editorial-discipline","client-portals","self-service-adoption","privacy-pipeda","build-vs-buy-software"],"reference_body":"**Status:** Synthesised June 2026. Sister brief to [[research-brief-customer-facing-calculators-smb-june-2026]] and [[research-brief-data-driven-tools-smb-june-2026]] — same skeptical, source-incentive-flagged methodology.\n\n## TL;DR — the honest verdict\n\nFor most SMBs the right answer is **buy, not build** — and for many the right answer is **\"you don't need one at all.\"** A bought portal is cheap and ubiquitous (real platforms start at **$19-79/month** across every sector: [[suitedash-pricing-19mo-unlimited-users]], [[honeybook-dubsado-pricing-tiers-2026]], [[clio-jobber-housecall-pricing-vertical-bundles]]). A custom build runs **$20K-60K + 15-20%/year maintenance** ([[custom-portal-build-20-60k-15-20pct-maintenance]]) and over five years routinely exceeds the bought version while concentrating all the security / breach / patching risk on the SMB.\n\nThe strongest independent finding is the **adoption gap**: Gartner found only **14% of customers fully resolve service issues in self-service** in 2024 ([[gartner-2024-14pct-self-service-resolution]]); only 9% in 2019 ([[gartner-2019-9pct-self-service-resolution]]). Practitioners report **40-60% of clients never log into portals set up for them** ([[40-60pct-clients-not-logged-in-90-days]]) — the \"ghost login\" is the dominant failure mode.\n\nThe viral **\"42% of customers abandon portals out of frustration / 43% prefer email\"** pairing is **misattributed** ([[42pct-portal-abandonment-misattribution-correction]]) — the 42% traces to e-commerce cart-abandonment research. The widely repeated **market-size projections** range ~7× between sources ([[portal-market-size-7x-spread-vendor]]) — treat as marketing, not fact.\n\n## The decision rule\n\nA portal earns its place when **three things are true at once**: client interactions are **frequent**; the work is **document- or approval-heavy**; and the back-and-forth it replaces is **real and measurable** ([[rule-portal-three-trigger-test]]). Hit all three (busy bookkeeping practice at tax time, property manager fielding maintenance, law firm collecting signatures) and a *bought* portal pays for itself. Miss them and you have bought a login nobody uses **plus** a privacy obligation you didn't need.\n\n## What the brief recommends\n\n- **Default to buy, not build** ([[rule-default-buy-portal-not-build]]).\n- **Run a 90-day adoption test** with a cheap bought portal before committing ([[rule-run-90-day-portal-adoption-test]]).\n- **Apply the three-trigger test** before recommending any portal ([[rule-portal-three-trigger-test]]).\n- **Treat data custody as a line item, not a footnote** ([[rule-treat-data-custody-as-line-item]]).\n- **Ignore retention-lift marketing; verify efficiency claims against the actual inbox** ([[rule-ignore-portal-retention-marketing-verify-efficiency]]).\n\n## Data custody — the cost vendors elide\n\nA login you control makes you accountable under **PIPEDA** ([[pipeda-core-duties-consent-safeguarding-access]]) — including **mandatory breach reporting since November 2018** with a **24-month record-keeping requirement for *all* breaches** ([[pipeda-breach-reporting-rrosh-24-month-records]]) and **penalties up to CAD $100,000 per violation** ([[pipeda-100k-per-violation-penalty]]). The principal organisation stays accountable even when a SaaS processor holds the data ([[control-accountability-third-party-processor]]). Quebec **Law 25**, **GDPR**, and **CCPA/CPRA** are the equivalents elsewhere ([[quebec-law-25-gdpr-ccpa-analog]]).\n\n## Source-incentive meta-finding\n\nNearly every portal *demand* and *ROI* claim originates from vendors that sell portals. The independent anchors are **McKinsey** ([[mckinsey-smb-channel-preference-2022]]) on SMB channel preferences and **Gartner** on self-service resolution rates ([[gartner-2024-14pct-self-service-resolution]], [[gartner-2024-why-self-service-fails-45pct-43pct]]). Nearly everything else is incentive-laden — see [[caveats-client-portals-vendor-marketing-base]].\n\n## The article\n\nThe publication-ready prose draft lives at [[article-client-portals-for-smbs-when-worth-it]] (Candid /writing/ candidate, SMB audience).","rationale_body":"Compiled June 2026 alongside calculators + data-tools briefs. Heart of the brief: the adoption gap (Gartner / practitioner) plus PIPEDA accountability — both routinely buried by portal vendors.","metadata":null,"links":{"outgoing":[{"slug":"research-brief-customer-facing-calculators-smb-june-2026","title":"Research brief: customer-facing calculators & tools for SMBs — the honest case (June 2026)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-data-driven-tools-smb-june-2026","title":"Research brief: live data and data-driven tools for SMBs — when it's an edge, when it's overkill (June 2026)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"portal-definition-authenticated-private-account-scoped","title":"Definition: a client portal is a private, authenticated section of a business's software where a specific client logs in to see and do things tied to their own account","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"portal-vs-marketing-site-vs-ecommerce","title":"A portal is private + authenticated + account-scoped — unlike a marketing site (public, anonymous, same for everyone) or an e-commerce account (transaction/order-history oriented)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"portal-feature-spectrum-minimal-to-rich","title":"Portal feature spectrum: from single-document exchange to full self-service operations hub (status / approvals / e-sign / invoicing / scheduling / messaging)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"mckinsey-smb-channel-preference-2022","title":"McKinsey (2022, ~3,500 US SMBs) — SMBs use digital channels 20-30% more frequently than analog; \"assisted\" channels (chat, email) beat pure self-serve; <15% want phone/voice","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"gartner-2024-14pct-self-service-resolution","title":"Gartner (Aug 19, 2024; survey of 5,728 customers Dec 2023) — only 14% of customer service / support issues are fully resolved in self-service; even for \"very simple\" issues only 36% resolve fully","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"gartner-2019-9pct-self-service-resolution","title":"Gartner (2019, 8,398 customers) — only 9% of customers report resolving their issues completely via self-service","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"gartner-2024-why-self-service-fails-45pct-43pct","title":"Gartner (Aug 2024) — why self-service fails: 45% of self-service starters say \"the company didn't understand what they were trying to do\"; in 43% of failures users couldn't find relevant content","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"salesforce-vendor-asserted-portal-demand","title":"Salesforce State of the Connected Customer — vendor-asserted: 57% say self-service \"critical/very important\"; 59% prefer self-service for simple questions; 88% say experience as important as products","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"portal-market-size-7x-spread-vendor","title":"Portal \"market size\" projections range ~7× between sources (US$1.47B - $10.47B for the same period) — the spread itself is the finding","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"suitedash-pricing-19mo-unlimited-users","title":"SuiteDash — CRM + portal + projects + invoicing + scheduling; portal core; from $19/month unlimited users (2026)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"honeybook-dubsado-pricing-tiers-2026","title":"HoneyBook ($19/$36/$39/$79) and Dubsado ($20/$40 with portal subdomain on Premier) — creative/service-business portal bundles, 2026","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"clio-jobber-housecall-pricing-vertical-bundles","title":"Vertical SaaS portal bundles: Clio (legal $39-149/user), Jobber (home services ~$69), Housecall Pro ($59-169) — 2026","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"taxdome-karbon-buildium-appfolio-pricing-vertical-bundles","title":"More vertical bundles: TaxDome (~$58/user), Karbon (~$59/user), Canopy ($150 flat), Buildium ($58-400 by door count), AppFolio ($298 floor) — 2026","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"clinked-pricing-conflict-77-or-239-flag","title":"Clinked pricing conflict — agiled.app reports $77-297/month; Clinked's own pricing page (via Capterra) reports plans from $239/month; flagged for verification","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"custom-portal-build-20-60k-15-20pct-maintenance","title":"Custom portal build economics — $20K-60K initial, 3-12 months, 15-20%/year maintenance (~$3K-10K+/yr) for patches/auth/updates","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"narrow-cases-where-custom-portal-justified","title":"Five narrow cases where a custom portal is justified: unmodeled workflow / proprietary integration / portal-is-the-product / data-residency / scale-inversion","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"40-60pct-clients-not-logged-in-90-days","title":"Practitioner data: \"Most firms find 40-60% of clients haven't logged in in the last 90 days\" — the ghost-login problem stated by an adoption-tool vendor","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"patient-portal-usage-32pct-academic","title":"Patient portal usage (academic, adjacent benchmark): cross-sectional study 32.1% used (range 26-51%); ER real-time 17.4% of 1.28M; US national 2022: 77% offered, 68% accessed","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"nordpass-168-passwords-2024","title":"NordPass research (2024, 1,509 users surveyed) — people manage 168 passwords on average; 2026 update revised to ~120; ~20% reset weekly; ~60% prefer important info by email","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"42pct-portal-abandonment-misattribution-correction","title":"CORRECTION: the viral \"42% abandon portals out of frustration / 43% prefer email\" stat is misattributed — the 42% traces to Namogoo e-commerce cart-abandonment research, not portal logins","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"forrester-tei-35pct-deflection-vendor-sponsored","title":"Forrester TEI studies report ~35% support-ticket deflection from portals — but every TEI study is commissioned and paid for by the vendor whose product is studied; enterprise-scale","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"selection-effect-portal-retention","title":"\"Portal users retain better\" is a textbook selection effect — engaged clients both use portals AND retain; the portal does not cause the retention","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"pipeda-core-duties-consent-safeguarding-access","title":"PIPEDA core duties: meaningful consent, safeguards appropriate to sensitivity, data minimization, accountability (designated privacy officer), access/correction rights","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"pipeda-breach-reporting-rrosh-24-month-records","title":"PIPEDA mandatory breach reporting (in force Nov 1, 2018): report RROSH breaches to OPC + notify affected individuals + KEEP RECORDS OF ALL BREACHES for 24 months","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"pipeda-100k-per-violation-penalty","title":"PIPEDA penalties — up to CAD $100,000 per violation for knowingly failing to report, notify, or maintain breach records; OPC can refer to AG","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"control-accountability-third-party-processor","title":"PIPEDA control = accountability: the principal organisation controlling the data stays accountable even when a third-party processor holds it; contracts must address this","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"quebec-law-25-gdpr-ccpa-analog","title":"Quebec Law 25, GDPR (EU/UK), CCPA/CPRA (US) — analog privacy regimes; Quebec Law 25 specifically imposes stronger GDPR-comparable obligations than PIPEDA","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"ibm-ponemon-canadian-breach-cost-2024","title":"IBM/Ponemon Cost of a Data Breach (Jul 30, 2024; 604 orgs; Mar 2023-Feb 2024): Canadian average CA$6.32M (down from CA$6.94M in 2023); 2025 figure ~CA$6.98M per separate edition","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"caveats-client-portals-vendor-marketing-base","title":"Caveats for the client-portals brief: source-incentives are pervasive; the independent anchors are McKinsey and Gartner; market-size figures unreliable; the viral 42% stat is misattributed","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"rule-default-buy-portal-not-build","title":"R1 — Default to BUY, not build, for client portals; recommend a horizontal platform ($19-79/mo) or the bundled vertical-SaaS portal","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-run-90-day-portal-adoption-test","title":"R2 — Run a 90-day adoption test with a cheap bought portal before committing; if <40-50% of clients log in, the portal is solving a problem the client base doesn't have","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-portal-three-trigger-test","title":"R3 — Three-trigger test: only proceed with a portal when interactions are FREQUENT + DOCUMENT/APPROVAL-HEAVY + the deflected back-and-forth is REAL AND MEASURABLE","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-treat-data-custody-as-line-item","title":"R4 — Treat data custody as a project line item, not a footnote: PIPEDA consent + MFA + encryption + breach response plan + 24-month breach records all live in scope before launch","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-ignore-portal-retention-marketing-verify-efficiency","title":"R5 — Ignore portal retention-lift marketing entirely; verify efficiency claims against the actual SMB inbox","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"article-client-portals-for-smbs-when-worth-it","title":"Article (draft): Most small businesses don't need a custom client portal — some don't need one at all","kind":"reference","scope":"business","link_type":"relates-to"}],"incoming":[{"slug":"research-brief-dashboards-smb-june-2026","title":"Research brief: dashboards for SMBs — what's worth showing, and when an embedded one earns its keep (June 2026)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-interactive-tool-mechanisms-smb-june-2026","title":"Research brief: why interactive tools deepen a business's relationship with its audience — a mechanism-level research package (June 2026)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-information-asymmetry-decision-edge-june-2026","title":"Research notes (capture-layer): the affirmative, inward decision-edge case for data intelligence — information asymmetry applied to pricing, demand, risk, retention, targeting (June 2026)","kind":"research-notes","scope":"business","link_type":"relates-to"}]},"created_at":"2026-06-20T17:57:32.047Z","updated_at":"2026-06-20T17:57:32.047Z"}