Research brief: client portals for SMBs — the honest case (June 2026)

Status: Synthesised June 2026. Sister brief to Research brief: customer-facing calculators & tools for SMBs — the honest case (June 2026) and Research brief: live data and data-driven tools for SMBs — when it's an edge, when it's overkill (June 2026) — same skeptical, source-incentive-flagged methodology.

TL;DR — the honest verdict

For most SMBs the right answer is buy, not build — and for many the right answer is "you don't need one at all." A bought portal is cheap and ubiquitous (real platforms start at $19-79/month across every sector: SuiteDash — CRM + portal + projects + invoicing + scheduling; portal core; from $19/month unlimited users (2026), HoneyBook ($19/$36/$39/$79) and Dubsado ($20/$40 with portal subdomain on Premier) — creative/service-business portal bundles, 2026, Vertical SaaS portal bundles: Clio (legal $39-149/user), Jobber (home services ~$69), Housecall Pro ($59-169) — 2026). A custom build runs $20K-60K + 15-20%/year maintenance (Custom portal build economics — $20K-60K initial, 3-12 months, 15-20%/year maintenance (~$3K-10K+/yr) for patches/auth/updates) and over five years routinely exceeds the bought version while concentrating all the security / breach / patching risk on the SMB.

The strongest independent finding is the adoption gap: Gartner found only 14% of customers fully resolve service issues in self-service in 2024 (Gartner (Aug 19, 2024; survey of 5,728 customers Dec 2023) — only 14% of customer service / support issues are fully resolved in self-service; even for "very simple" issues only 36% resolve fully); only 9% in 2019 (Gartner (2019, 8,398 customers) — only 9% of customers report resolving their issues completely via self-service). Practitioners report 40-60% of clients never log into portals set up for them (Practitioner data: "Most firms find 40-60% of clients haven't logged in in the last 90 days" — the ghost-login problem stated by an adoption-tool vendor) — the "ghost login" is the dominant failure mode.

The viral "42% of customers abandon portals out of frustration / 43% prefer email" pairing is misattributed (CORRECTION: the viral "42% abandon portals out of frustration / 43% prefer email" stat is misattributed — the 42% traces to Namogoo e-commerce cart-abandonment research, not portal logins) — the 42% traces to e-commerce cart-abandonment research. The widely repeated market-size projections range ~7× between sources (Portal "market size" projections range ~7× between sources (US$1.47B - $10.47B for the same period) — the spread itself is the finding) — treat as marketing, not fact.

The decision rule

A portal earns its place when three things are true at once: client interactions are frequent; the work is document- or approval-heavy; and the back-and-forth it replaces is real and measurable (R3 — Three-trigger test: only proceed with a portal when interactions are FREQUENT + DOCUMENT/APPROVAL-HEAVY + the deflected back-and-forth is REAL AND MEASURABLE). Hit all three (busy bookkeeping practice at tax time, property manager fielding maintenance, law firm collecting signatures) and a bought portal pays for itself. Miss them and you have bought a login nobody uses plus a privacy obligation you didn't need.

What the brief recommends

• Default to buy, not build (R1 — Default to BUY, not build, for client portals; recommend a horizontal platform ($19-79/mo) or the bundled vertical-SaaS portal).
• Run a 90-day adoption test with a cheap bought portal before committing (R2 — Run a 90-day adoption test with a cheap bought portal before committing; if <40-50% of clients log in, the portal is solving a problem the client base doesn't have).
• Apply the three-trigger test before recommending any portal (R3 — Three-trigger test: only proceed with a portal when interactions are FREQUENT + DOCUMENT/APPROVAL-HEAVY + the deflected back-and-forth is REAL AND MEASURABLE).
• Treat data custody as a line item, not a footnote (R4 — Treat data custody as a project line item, not a footnote: PIPEDA consent + MFA + encryption + breach response plan + 24-month breach records all live in scope before launch).
• Ignore retention-lift marketing; verify efficiency claims against the actual inbox (R5 — Ignore portal retention-lift marketing entirely; verify efficiency claims against the actual SMB inbox).

Data custody — the cost vendors elide

A login you control makes you accountable under PIPEDA (PIPEDA core duties: meaningful consent, safeguards appropriate to sensitivity, data minimization, accountability (designated privacy officer), access/correction rights) — including mandatory breach reporting since November 2018 with a 24-month record-keeping requirement for all breaches (PIPEDA mandatory breach reporting (in force Nov 1, 2018): report RROSH breaches to OPC + notify affected individuals + KEEP RECORDS OF ALL BREACHES for 24 months) and penalties up to CAD $100,000 per violation (PIPEDA penalties — up to CAD $100,000 per violation for knowingly failing to report, notify, or maintain breach records; OPC can refer to AG). The principal organisation stays accountable even when a SaaS processor holds the data (PIPEDA control = accountability: the principal organisation controlling the data stays accountable even when a third-party processor holds it; contracts must address this). Quebec Law 25, GDPR, and CCPA/CPRA are the equivalents elsewhere (Quebec Law 25, GDPR (EU/UK), CCPA/CPRA (US) — analog privacy regimes; Quebec Law 25 specifically imposes stronger GDPR-comparable obligations than PIPEDA).

Source-incentive meta-finding

Nearly every portal demand and ROI claim originates from vendors that sell portals. The independent anchors are McKinsey (McKinsey (2022, ~3,500 US SMBs) — SMBs use digital channels 20-30% more frequently than analog; "assisted" channels (chat, email) beat pure self-serve; <15% want phone/voice) on SMB channel preferences and Gartner on self-service resolution rates (Gartner (Aug 19, 2024; survey of 5,728 customers Dec 2023) — only 14% of customer service / support issues are fully resolved in self-service; even for "very simple" issues only 36% resolve fully, Gartner (Aug 2024) — why self-service fails: 45% of self-service starters say "the company didn't understand what they were trying to do"; in 43% of failures users couldn't find relevant content). Nearly everything else is incentive-laden — see Caveats for the client-portals brief: source-incentives are pervasive; the independent anchors are McKinsey and Gartner; market-size figures unreliable; the viral 42% stat is misattributed.

The article

The publication-ready prose draft lives at [[article-client-portals-for-smbs-when-worth-it]] (Candid /writing/ candidate, SMB audience).