# Client Project Access

Client project access lets you invite people outside your organisation into selected projects. It is designed for client stakeholders who need visibility into project progress, recorded hours, and client-facing billing totals without becoming part of your internal delivery team.

## Client Organisations vs Client Accounts

Keito uses "client" in two related ways:

| Term | Meaning |
|------|---------|
| Client organisation | The company or customer record that owns projects, invoices, contacts, currency, and billing details. |
| Client account | A person from that client organisation who can sign in and view projects you assign to them. |

Employees and contractors are internal workforce members. They usually track time, submit expenses, have capacity and rates, and may receive internal permissions. Client accounts are external members. They are regular workspace members with a client classification and project-level access only.

## Adding a Client to a Project

The usual flow is to invite the client directly from the project:

1. Open **Projects**.
2. Select the project you want to share.
3. Click **Edit**.
4. Go to **Project member permissions**.
5. Use **Invite someone to this project**.
6. Enter the client's name and work email.
7. Set **Invite as** to **Client**.
8. Review the project permissions.
9. Click **Send invite**.

The default client settings are:

| Permission | Default | Meaning |
|------------|---------|---------|
| Track time | Off | The client cannot log time or expenses against the project. |
| Client view | On | The client can view project hours and client-facing financial totals. |
| Internal costs | Off | The client cannot see cost rates, cost budgets, or internal cost totals. |
| Manages project | Off | The client is not a project manager. |

You can also invite a person from **Team > Invite person** and choose **Client** as their type. That creates the client account, but it does not automatically grant project access. Assign them from the project's **Project member permissions** section when you are ready to share a project.

## Client Permissions

Client accounts are restricted compared with employees and contractors:

- They are added as regular members, not managers or administrators.
- They cannot receive internal business roles.
- They do not get manager permissions.
- Their internal role data is cleared if an eligible internal member is converted to a client.
- Once someone is a client account, they cannot be converted back into an employee or contractor account.
- They only access projects where they have an active project assignment.

Administrators control who is invited and what each client can see on each project.

## What Clients Can See

A client with **Client view** enabled can open the assigned project and see the project-facing view:

- Project name, client, project dates, code, and status.
- Total project hours.
- Billable and non-billable hour totals.
- Tasks on the project.
- People assigned to the project.
- Billable amounts and client-facing financial totals.
- Budget progress when the budget is based on hours or billable fees.
- Uninvoiced amount for the project.
- Date filters on the project activity view.

They do not see the internal invoice tab, detailed reports, data exports, workspace settings, team management, integrations, client directory management, or invoice management unless they also have an internal role. Client accounts cannot have those internal roles.

## Permission Options

Project permissions are configured per person.

### Track Time

Allows the person to use time and expense entry screens for this project. This is usually on for employees and contractors, and off for clients.

If a client is allowed to track time, they can access the time tracking surfaces for assigned active projects. Use this only when the client is expected to contribute work inside your workspace.

### Client View

Gives read-only access to project-wide activity and client-facing financial totals. This is the normal setting for client stakeholders because it lets them understand progress and billable value without exposing internal costs.

### Internal Costs

Shows internal cost totals and cost-based budgets. Turning this on also enables **Client view**, because internal costs are shown alongside the project's financial view.

Keep this off for client accounts unless you have a specific commercial reason to disclose internal cost data.

### Manages Project

Marks someone as a project manager for internal project workflows. This is intended for employees or contractors with manager-level responsibilities. Client accounts remain regular members, so this should normally stay off for clients.

## Invite Process

When you send a project invite:

1. Keito sends an email invitation through WorkOS.
2. The invitation expires after 7 days.
3. Keito stores the selected project permissions with the pending invitation.
4. The pending client appears in the project's permission table before they accept.
5. You can adjust their project permissions while the invitation is still pending.
6. When the client accepts, Keito creates or links their user account, classifies them as a client, and applies the pending project assignment.
7. The client can then sign in and view the assigned project.

If the email address already belongs to an active workspace member, Keito assigns that person to the project immediately instead of sending another invitation. If there is already a pending invitation for the email address, Keito updates that invitation with the new project assignment instead of sending a duplicate.

## Recommended Setup

- Invite clients from the project they should see, not from the general team invite flow.
- Keep **Track time** off unless the client will record their own work.
- Keep **Internal costs** off for external stakeholders.
- Use **Client view** for transparent project progress and billing visibility.
- Add one client account per client stakeholder who needs their own login.