Client Portal v5.9.1 – Client and Project Management WordPress Plugin

Flow is a kanban project management app built for agencies and studios — and the client is in the room.

Every client gets a board. Every piece of work is a card. And when a design goes out for approval, the client signs in and sees exactly that: their board, the columns you switched on, and the comments you chose to share. Nothing else. No forwarding screenshots, no “did you see my email”, no paying for a seat on a SaaS just so a client can say yes.

Flow is self-hosted team collaboration software. One docker compose up on your own server, your data on your own disk, no subscription and no per-seat fee — for your team or for your clients.

Your clients get a login, not an invoice

This is the part other kanban scripts leave out. A client account in Flow is not a cheaper member account — it is a proper client portal, locked down by default.

• One board, theirs — a client sees the board you attached them to and no other. Other clients do not exist as far as their session is concerned.
• Columns you choose — switch visibility on per column. Your Backlog and In Progress stay internal; Client Review and Done are what they see.
• Comments you choose — every comment is internal unless you mark it shared. The team talks freely on the same card the client is looking at.
• They answer, they don’t edit — a client can read, comment, react, and approve or request changes. They cannot move a card, rename a column, or reach the team, the settings or anything else.
• Approval that moves the work — when a client approves, the card lands in Done with a completion date and the assignee is notified. When they ask for changes, it goes back to In Progress with their reason attached.

A board that knows what its columns mean

• Drag and drop kanban — cards between columns, columns into the order you want. Board view or list view, whichever suits the day.
• Columns carry meaning, not just a name — each column is queued, in progress, client review or done underneath. Call it “Waiting on Client” or “Müşteride” if you like; completion dates, statistics and the client’s view follow the meaning, not the words.
• Search and filter — find a card by title across the board, or narrow it down to one person’s work.
• Archive — finished clients and cards leave the board without leaving your records.

Cards with enough room for real work

• Rich descriptions — headings, lists, links and formatting, not a single-line text field.
• Subtasks with a progress bar — break a card into steps and watch 3/7 become 7/7.
• Labels from shared templates — define them once for the workspace, put them on any card.
• Due dates and priorities — with overdue cards called out where you will actually see them.
• Mentions and reactions — @someone and they hear about it; react to a comment instead of writing “ok”.
• A full activity log — who moved it, who assigned it, who changed the date, and when.

Design files are first-class — and video and audio play on the card

• Attach PSD, AI, EPS, Figma, XD, Sketch and PDF alongside images (JPG, PNG, GIF, WebP, AVIF), Office documents, CSV and archives.
• Video and audio play where the work is. MP4, WebM, MOV, M4V and OGV open in a player on the card, and so do MP3, WAV, M4A, AAC, OGG and FLAC. No download, no second tab, no separate tool for the client to learn.
• They are served with byte ranges, so you can drag the scrubber into the middle of a long cut instead of waiting for it — and so iOS Safari will play them at all.
• MKV, AVI and MXF are stored and downloaded, never played. Playing them would mean transcoding, which this product does not do. An editor can still hand the client an MXF straight from the card.
• You decide what your install accepts. Six groups of file kind and a size limit, in Settings: images, documents, design files, archives, video, audio. The default is 25 MB and the ceiling is 100 MB, because the upload is held in memory while it runs — that figure is measured, not guessed.
• The groups are a fixed catalogue with no free-text field. Anything a browser can execute — .html, .svg, .php and their relatives — belongs to no group and cannot be switched on by anyone, including you.
• Every upload is checked against its own signature rather than its extension: ftyp for the MP4 family, EBML for WebM, RIFF for WAV. A .mp4 that is not an MP4 is refused, and nothing of it is kept.
• Images are compressed in the browser before they ever reach your server.
• Download every attachment on a card as one ZIP — the handoff that usually costs you a WeTransfer link.
• Files are never served from a public folder. Every download and every play runs through the same permission check, so an attachment URL is worthless to anyone who is not entitled to it.

My Work — what is actually on you today

Everything assigned to you across every client board, in one place, grouped by overdue, today, upcoming and later. Plus the cards you created and the ones you were mentioned in. Nobody has to open six boards to find out what to do next.

An overview that answers the Monday question

A dashboard with the numbers you actually get asked about: how many clients you are carrying, how many cards are active, how many are urgent and waiting. This week’s activity as a chart — completed against opened — and the split of cards across columns at a glance.

Roles, and a team screen that respects them

• Admin — the whole workspace: clients, team, settings, mail, AI.
• Member — the boards they are on. Cards, comments, files, everything except the workspace’s own settings.
• Client — one board, read and answer, nothing else.

Invite people, set their role, attach a client to their board, reset a password — from one screen, without touching the database.

Notifications that respect people

In-app and email, with a separate on/off switch for each kind of event: a card assigned to you — new or handed over — an @mention, someone quoting your comment, your card changing status, a client approving or asking for changes, and every card movement on your boards. Notifications are grouped, so five quick comments arrive as one message instead of five. Email goes out in the recipient’s own language over your own SMTP.

Bring your own AI — or none at all

Split a card into subtasks with a model of your choosing: OpenAI, Anthropic (Claude), Google (Gemini), OpenRouter, NVIDIA, a local Ollama, or any OpenAI-compatible endpoint. Paste your own key in Settings and it is stored encrypted — never sent to a browser, never leaving your server except to the provider you picked.

Leave it empty and the button never appears. There is no AI subscription bundled into this product, no shared key, and no usage that runs through us — because there is no “us” in a self-hosted app.

Please read before buying. The AI feature requires your own account with one of those providers, and those services are paid separately by you, directly to them. OpenAI, Anthropic, Google, OpenRouter and NVIDIA each require you to register and, in most cases, to hold a paid subscription or a pay-as-you-go balance before an API key will answer at all. No API key, subscription, credit or trial is included with this item, and no part of its price covers provider usage. Every other feature in Flow works with the AI section left empty — and a model you host yourself with Ollama needs no key and no account.

English and Turkish, per person

The whole interface, notifications, activity log and emails are translated. The language is a workspace default that each person can override for themselves — so a client abroad reads their board in their own language while your team reads it in yours. Stored text is language-neutral and resolved when it is read, which means a card’s history reads correctly to both of them.

Yours to run

• One command install — docker compose up -d. Application and PostgreSQL, ready.
• A setup screen that checks your server first — before it asks for anything it tells you whether the database is reachable and migrated, whether it can write attachments and logos, and whether you are on HTTPS. Then: name the workspace, create the owner, and optionally load a sample studio with four clients and sixteen cards so you can see how everything fits before you touch your real work.
• Automatic migrations — an update is a rebuild. The application brings its own database forward; you never run SQL by hand.
• Backup and restore with one script, ready for cron — database and uploaded files together.
• Your own logo — upload your agency’s logo in Settings and it replaces ours on the sign-in screen and along the top of the sidebar. Separate, optional slots for a dark-background version and for the square mark the collapsed sidebar needs.
• Dark mode, and a layout that works on a phone and a tablet, not only on your monitor.
• White label — the “Developed by” signature in the sidebar can be switched off in Settings.

Security you can point at

• Passwords hashed with bcrypt; a minimum length enforced everywhere an account is created, not just on the setup screen.
• Taking access away takes it away. Change someone’s role, delete their account, or change a password, and every session already open in their browser stops working — on the next request, not whenever the sign-in eventually expires. Sessions last a week, not a month.
• Your SMTP password and AI keys are encrypted at rest (AES-256-GCM) and are never sent to a browser, not even to the admin who typed them.
• Login is rate-limited and failed attempts are recorded.
• Uploads are validated by content, not just by file extension — a renamed executable does not get in.
• A Content Security Policy is on by default, along with the usual hardening headers.
• It checks its own configuration on start and refuses to run with an empty or example signing secret, or with the database password printed in the sample file — the two mistakes that quietly hand an install to whoever noticed.
• The client role is enforced by a single allowlist: anything not explicitly permitted is refused. A route added to the app later is closed to clients by default rather than open by accident.

Under the hood

Next.js 16, React 19, TypeScript throughout, Prisma with PostgreSQL 15, and a multi-stage Docker build. Full source included — readable, commented where it matters, and organised so you can actually change it.

Requirements — please read this one

Flow is a Node.js application, not a PHP script. It needs:

• A Linux VPS with 2 GB RAM, Docker and the Docker Compose plugin
• A domain or subdomain
• A reverse proxy for HTTPS — nginx with Let’s Encrypt is documented step by step

Flow does not run on shared PHP/cPanel hosting. If that is what you have, this is not the right item for you. On a blank VPS the installation guide takes about fifteen minutes.

What you get

• The complete source — Next.js, React, TypeScript, Prisma schema and migrations
• Dockerfile and compose files for development and production
• An installation guide, from blank VPS to HTTPS, in HTML and Markdown
• A user guide covering every screen
• The backup and restore script
• Third-party licence notices — every dependency is MIT, Apache-2.0 or ISC
• Six months of support, extendable

Try it before you buy it

https://flow.webosentez.com — a full working install that resets every 15 minutes.

• Agency side: demo / demo-flow-2026 — the whole product
• Client side: client / client-flow-2026 — the same board through your client’s eyes

Sign in as both. The difference between the two is the reason this item exists.

Changelog

2.1.0 — 23 September 2026

• Video and audio play on the card. MP4, WebM, MOV, M4V, OGV; MP3, WAV, M4A, AAC, OGG, FLAC. Served with byte ranges, so the scrubber works and iOS Safari will start them.
• Settings → Attachments. The owner chooses which kinds of file the workspace accepts and the largest a single file may be, up to 100 MB.
• More formats kept and handed back as downloads: MXF, MKV, AVI, TIFF, BMP, HEIC, AVIF, RTF, Markdown, EPUB, OpenDocument, InDesign, 7z, tar, gzip.
• Uploads stream to disk instead of being read into memory, and the limit is enforced as the bytes arrive rather than only against the size the caller declares.
• FIXEDan attachment over 10 MB was silently truncated to 10 MB and the upload reported success. This affected 2.0.1, so take this update even if nothing else here matters to you — and check any attachment you uploaded before it.

2.0.1 — 16 September 2026

• Installation and upgrade documentation corrected; packaging fixes.

2.0.0 — 6 September 2026

• First public release.