Share client reports

Before you share a client report

Client report sharing controls who can view a report and whether the shared surface uses agency branding. Use this page when an agency project already belongs to the correct client workspace and a report is ready for client review. Sharing is not a substitute for project assignment or report review. Confirm the client account, report readiness and white-label state before turning on external links. Client portal links use `/client-portal/{publicToken}` after sharing is saved. Client portal access is report-only: it shows the assigned client report and approved client-facing presentation without agency billing, unrelated client projects, private workspace controls or team-management screens.

Enable client-safe links

Follow the path `Agency → Client project → Sharing → Client-safe links → Portal/Public link`.

1. Open /agency and find the agency workspace that owns the client project. Result: the Client project table shows client account, report status, sharing state, public brand and export brand for each project.
2. Confirm the project is assigned to the correct client account before changing sharing. Result: the report cannot be sent to the wrong client workspace by mistake.
3. Confirm the report is ready for client review and not still draft, missing evidence or blocked by publication state. Result: client-safe links are enabled only for a report that should be visible.
4. In the Sharing column, turn on Client-safe links. Result: WebRiskOps prepares portal, public, print and PDF links tied to the report public token when the report can be shared.
5. Click Save sharing. Result: the row shows a shared state and exposes Portal, Public link, Print and PDF actions when links are available.
6. Open Portal or Public link before sending it externally. Result: the client sees only the assigned report with the intended white-label visibility and no private workspace controls.

Verify the shared report

Before sending a link, review the public report or portal view in a browser session that is not using owner-only workspace context. Confirm the report title, affected domain, issue evidence, white-label presentation and legal boundary wording are correct.

Continue to notification preferences

After links are verified, continue to [Set notification preferences](/docs/accounts/notification-preferences) so the right team members receive report-ready and client status updates. For public token behavior and client-safe surfaces, continue to [Understand public reports](/docs/reports/public-reports).

Availability boundaries

Sharing depends on report readiness, client assignment, publication state and white-label eligibility.

• No client account means the project should be assigned before external sharing is enabled.
• Report not ready means the report should stay private until evidence, findings and publication state are complete.
• Token unavailable means Portal, Public link, Print or PDF actions stay hidden until sharing is saved and the report can expose a public token.
• Revoked sharing means the public token should no longer be treated as client-accessible.
• Client visibility boundary means client viewers see only their assigned reports, not agency billing, unrelated clients or private workspace controls.
• Client portal access is report-only means portal readers can review the assigned report and links, but cannot open agency settings, other client workspaces, team invitations or billing controls.