Features · Customer portal
Give every customer a window into what they own
The same platform that designs and installs the work becomes each customer’s branded self-service view — inventory, orders, renewals, and reports, isolated per tenant at the data layer and backed by an asset ledger you can audit to the event.
White-label self-service
Self-service that carries your brand
Each customer gets a branded portal onto their own slice of your records: inventory, orders, renewals, and reports. It is a window, not an export — the portal reads live from the same source records your team works on.
- Inventory, orders, renewals, and reports in one branded view per customer
- A report builder with saved configurations — private to their author, or shared to the customer
- Live from your source records — nothing re-keyed, nothing gone stale
One window per customer
- Inventory
- projected from the ledger
- Orders
- live, with tracking
- Renewals
- the same records your team sees
- Reports
- saved, private or shared
Tenant isolation
Isolation enforced where it counts
A hidden button is not a security boundary. Portal isolation is enforced in the data layer’s security rules — every read is predicated on the customer’s own tenant key — and verified a second time in application code that fails closed and logs any mismatch as a security event.
- Rules-layer isolation: a customer can only read records carrying their tenant key
- A second, fail-closed verification in application code — deny on any doubt
- Internal-only records stay internal by rule, not by interface filter
Two layers, one boundary
- First line
- data-layer security rules
- Second line
- fail-closed app verification
- On mismatch
- denied and logged as a security event
- UI filters
- convenience, never the boundary
The asset ledger
An inventory you can audit
Device movement is an append-only ledger, not an editable list. Every movement is an event with a signed quantity — received, deployed, returned, retired, adjusted — and on-hand inventory is computed from the ledger, so the balance equation holds by construction rather than by reconciliation.
- Append-only events: received, deployed, returned, retired, adjusted
- On-hand is a projection — begin + received − deployed + returned − retired = end, as an identity
- Corrections are new events, never edits — history stays honest
- Device tiers resolve at report time from stored inputs, so a policy change reclassifies history consistently
- Per-customer hardware-refresh policy, maintained by your admins
How the ledger works
- Event
- signed quantity, append-only
- Inventory
- a projection of events
- Corrections
- new events, not edits
- Tiers
- evaluated at report time
Built to be audited
Structural facts about the portal’s data model — no invented benchmarks.
- Append-only
- every device movement is a ledger event
- received · deployed · returned · retired · adjusted
- An identity
- begin + received − deployed + returned − retired = end
- inventory is computed, not maintained
- Two layers
- tenant isolation in rules and app code
- fail-closed, mismatches logged
- White-label
- branded per customer
- inventory, orders, renewals, reports
Customer portal questions
Is the portal really isolated per customer?
Isolation is enforced in the data layer’s security rules and verified again in application code, which fails closed and logs any mismatch as a security event. A customer can only read records carrying their own tenant key — the interface filter is a convenience on top, never the boundary.
What keeps the inventory numbers trustworthy?
Inventory is not an editable list. Every movement is an append-only ledger event with a signed quantity, on-hand is computed from the ledger, and corrections are new events rather than edits — so begin plus received minus deployed plus returned minus retired always equals end.
Can customers build their own reports?
Yes — a report builder with saved configurations. A saved config can stay private to its author or be shared to the customer, and that sharing scope is enforced by rule, not by convention.
Whose brand is on the portal?
Yours. The portal is white-label and configured per customer, reading live from your source records — your customers see your brand and their data, nothing else.
Give your customers their own window
A branded portal on your source records, isolated per tenant, with an inventory you can audit to the event.