Your clients log into a branded, scoped portal (SSO or magic link), no shared PDFs over email. Critical and High findings auto-disclose the moment they are confirmed, and clients raise disputes, evidence, and retest requests without ever leaving it.
A report is only as good as how it lands. The Client Portal gives every client a secure, branded home for their findings, disclosed automatically on delivery, scoped to just their engagements, and wired for the back-and-forth that follows: disputes, evidence, and retests.
Branded, access-scoped, and automated, so delivery is a moment in the workflow, not a manual email with an attachment.
A separate client role, enforced at the middleware layer on every query, so a portal user can never reach another client’s data. Sign in by SSO (OIDC or SAML), single-use magic link, or password. Tokens are hashed, cookies are httpOnly, endpoints are rate-limited.
Per-org branding drives the logo, favicon, fonts, and full light/dark color set, with custom-domain support and DNS verification. Clients land on a portal that carries your name end to end. No “powered by” footer.
The moment a report is delivered, every undisclosed Critical and High finding is released to the client in the portal. Configure your own SMTP and a notification goes out over it too, from your domain, with credentials encrypted at rest using AES-256-GCM. Disclose any finding by hand too. No manual “I’ll email you the highlights.”
Clients raise severity disputes, amendment requests, remediation evidence, and general inquiries, each routed to your team for review, with status tracking and attachments. Retest requests flow through the same review-and-schedule workflow.
Delivering a report fans out automatically to disclosure and in-portal notification, and to email once you have configured your own SMTP.
The product tour steps through the branded portal, auto-disclosed findings, and the request workflow as a client sees them. Or book a live walkthrough.
Logo, favicon, fonts, and the full light/dark color set are per-org, and you can serve the portal on your own custom domain with DNS verification. Clients see your brand throughout. There is no Cairn “powered by” footer.
No. Client accounts carry a distinct role and are scoped to specific clients at the middleware layer, so every query is filtered before it runs. Access is granted per client and enforced on every request.
Yours, and only yours. Cairn does not send mail on your behalf: configure per-org SMTP and disclosure emails and invites send from your own domain, with credentials stored encrypted at rest with AES-256-GCM. Until you configure SMTP, no email is sent — the in-app half of disclosure still runs, so findings are released in the portal and the client sees them on sign-in.
From inside the portal. A client raises a retest request against resolved findings; your team reviews, approves, and schedules it, and the client sees the retest status and history against each finding.