Plexara
Client Access
What an external person reaches
What an external person can open
Most of what a client needs from your data team is an output: the monthly report, the dashboard for their account, the file you promised by Friday. Today that usually means a separate client portal, a file-sharing link, or a viewer seat in a BI tool, each with its own logins and its own copy of the work.
On Plexara the person outside your organization signs in to the same portal. An account in your identity provider, given a role that maps to an external group, is all it takes. The platform fixes what that person can reach, and no setting on their group can widen it.
A person from a client, signed in through your identity provider
Their role maps to an external group. Settings on that group can narrow the left column. Nothing on it can open the right one.
Reaches
- The reports, dashboards, decks, and collections shared with them or with their group
- The files shared with them, and a folder of their own for files they send you, when you allow it
- The feedback threads you mark as shared, where they can reply
- Downloads and earlier versions, each only when you turn it on
- Their own notification settings
Never reaches
- Any AI agent, and every tool an agent uses, including search
- Your connections, the catalog, the knowledge base, prompts, and automations
- Your internal feedback threads and your people directory
- Sharing anything onward, or creating API keys
- Any portal area outside that fixed set, including areas added in later releases
The Share dialog
One dialog for everyone who can open an item
Every report, dashboard, deck, collection, and file has the same Share dialog. Type a name and it offers people from your directory and groups, each group showing how many people it reaches. External people and groups are marked External wherever they appear, so nobody shares with a client by accident.
Sharing with a client’s group reaches everyone at that client and nobody else, and someone who joins the client later sees what was already shared with the group. Roles change in place, and a removal can be undone for a few seconds.
Each item also has one general link. Changing who it admits keeps the same address, so a link already sent in an email follows the new setting instead of leaving an old one open.
General access
Who opens the link
How long
Only people added
The people and groups listed on the item, each signed in as themselves.
Until you remove them. A forwarded link grants nothing.
Anyone who can sign in
Anyone with an account on your deployment who has the link.
Until you change it.
Anyone with the link
Anyone holding the link, without signing in.
Always on a clock: an hour, a day, a week, or thirty days.
The same dialog posts an item to a Slack or Mattermost channel as a link you can revoke later, and lists every channel it was posted to with how often each link was opened. Whether a group may share at all is one of its portal permissions.
Requesting access
Requesting access to an item
Links get forwarded. When someone signed in follows one to an item they cannot open, they can ask for it in one step, and the owner can grant it in one step. The same works for colleagues and for people outside the company.
- 1
Requester
Follows a link they cannot open
Instead of a dead end they see who owns the item and a Request access button, with room for a short note. Whether the page names the item is your admin’s choice.
- 2
Plexara
Tells the owner
The owner hears about it the way they chose to hear about things: by email, in the Inbox, and on the item’s Share dialog. Asking again while a request waits notifies nobody.
- 3
Owner
Approves as viewer or editor, or declines
From the email, the Inbox, or the dialog. Approving shares the item, so the link the person already has opens without another step. An external person is held to viewer either way.
- 4
Plexara
Tells the requester
Either answer is emailed. A request nobody answers expires, 14 days by default, and can then be made again. One person can ask for one item at most three times a day.
Setting it up
Accounts in your provider, rules in the portal
Nobody keeps a second list of client logins. Accounts live where your other accounts live, and the portal decides what an external role means.
01
Your identity provider
The client’s people get accounts and a role, the way your own staff do. Their sign-in, password rules, and second factor are whatever your provider enforces, and removing the account there ends their access.
02
Admin > Personas
An admin creates a group for the client, sets its account type to External people, and maps the client’s role to it. One group per client organization keeps each client’s view separate.
03
Portal access
On the same page the admin turns downloads, earlier versions, feedback, and uploads on or off for the group. Areas that are closed to external people cannot be opened here.
04
External files
Files a client uploads land in that person’s own folder, shared with no one on arrival. The staff groups the admin chooses see them under External files in the Resources page.
05
Access summary
Every group’s page lists what it can reach and every grant elsewhere that names it: shares, its people, and anything else it touches, so an admin can see a client’s whole footprint in one place.
Where it fits
Where client access fits
When the work already lives in Plexara, sharing it from there removes a copy. Each of these can move over when it comes up for renewal, without touching the others.
Category
What Plexara covers
What stays with a dedicated tool
Client deliverables portals
Reports, dashboards, and decks your team or your automations produce, shared per client and refreshed in place.
Project management, invoicing, and client onboarding workflows.
External file exchange (file sharing with outside parties)
Files shared with a client, and a folder for each person at the client to send files back, under the same access rules.
General document collaboration and editing.
Viewer seats in a BI tool for outside parties
People who only need to see results, without a seat in your analytics stack.
Analytics embedded inside your own product, and sharing data into another company’s warehouse.
The rule underneath is the same one every connection and tool follows on Plexara: nothing is reachable until it is granted. Read closed by default for why.
Common questions
Client access FAQ
Yes. A client’s people sign in through your identity provider with a role that maps to an external group. They see the reports, dashboards, collections, and files shared with them, as viewers, and nothing else. Every AI agent tool, including search, is refused for them, whatever else the group allows.
The account is created in your identity provider, like any other account, with a role your admin maps to that client’s external group in the portal. Removing the account in your provider removes their access, and nobody keeps a second list of client logins.
When the admin allows uploads for the client’s group, each person gets a folder of their own. Uploads are shared with no one on arrival, and the staff groups your admin chooses see them under External files.
Not through Plexara. An external person reaches only what was shared with them or with their own group, and cannot share anything onward. Keeping one external group per client organization keeps every client’s view separate.
The rules behind every group
Governance
Personas decide what each group of people and each agent can reach, from tools and connections to every area of the portal.