The partner financial firewall

Partners — your clients — see project progress, never project economics. That promise is the reason you can hand a client a login without a second thought, so it can't rest on a hidden button or a filtered screen. It is enforced three times over, at the data layer, where a partner's session simply cannot produce the rows or the columns in the first place.

This article is the how. For the plain-English version you can send a client, use "What partners can see — and what they never can".

The partner portal reads your project data from six purpose-built, partner-safe surfaces — and nothing else. Each one exposes an allowlist of columns — the financial fields are not filtered out of the result, they are not in the surface at all.

There is no people or roster screen in the portal at all. Where a partner does brush up against your staff — the name on a comment, for instance — a row rule on the people directory limits them to people who share a project with them. They can never enumerate your full staff roster.

And a partner sees a project only if you've explicitly added them to it. There is no "all projects" surface for a partner: no membership row, no visibility. Removing them from the project ends their access immediately, at the data layer.

Rates, costs, margins, budgets and budget burn, contract names, estimated and actual hours, time entries (not even a total), tickets, internal notes, AI project insights and risk scores, project charges, quotes, lifecycle and assessment data, the whole CRM, your staff roster, and any other client's anything.

1. 1
   Layer 1 — row-level rules on the underlying records

   A partner's session is scoped to their own workspace and only the projects they've been added to, before anything else applies. On most internal tables — the CRM, tickets, insights, other clients' work — that already means zero rows, so there is nothing to read even before columns come into it.
2. 2
   Layer 2 — restrictive deny rules

   On top of that, blanket deny rules subtract partner access from the money tables outright — projects, tasks, time entries, tickets, project insights, risks, charges, score snapshots, quotes, lifecycle records, and the CRM. Restrictive rules are ANDed with everything else, so they can only ever subtract. Even if someone later added a permissive rule by mistake, a partner still gets nothing.
3. 3
   Layer 3 — partner-safe surfaces with a column allowlist

   The portal reads only the partner surfaces above, which are row-checked to your workspace and to a project you're actually a member of — some in the surface itself, the rest by the row rules underneath — and carry no financial columns to begin with. The migration that built them ends in an automated self-check that verifies the surfaces, the shared-document flag, and the deny rules are all in place.

• ＋Posting a co-managed comment — and editing or deleting their own — is the only write a partner has into your project data. (They can also update their own profile details and their own notification read state, and the portal records their sign-in — nothing that touches a project, a record, or a number.)
• ＋If a partner is ever set as a task assignee, they still cannot edit or delete that task — the deny rules cover writes, not just reads.
• ＋Notifications sent to a partner may only carry portal links. Internal task and project names travel in staff-app links, so a partner is never sent one: a database guard drops any such notification before it lands, even from an automated assignment or deadline alert.
• ＋Time entries are hidden completely, including totals. If you're used to co-managed hours being visible to clients, they are not — that was deliberately closed in favour of zero financial exposure. See "Logging time and how it reaches your PSA's billing" for where hours do live.

• ＋Invite yourself with the Read-only / Partner role on a test project — the invite requires at least one project — and sign in as that account. You'll land in the portal — partners are held there and never see the staff app.
• ＋Confirm the projects list shows only the project you were added to. Add and remove yourself from a second project and watch visibility follow, immediately.
• ＋Confirm no document appears, and that a task description appears only on a task whose partner-facing flag is set in Autotask (on ConnectWise-synced projects, descriptions never appear).
• ＋Check that no hours, budget, or rate appears anywhere — including on the project summary, where staff see budget burn.