Security and data
Your clients’ data never touches someone else’s server
This is the reason to self-host. Every client, order, message, invoice and file lives in a database on a server you rent and control, and the only thing that leaves it is a licence check-in.
The self-hosted client portal your agency owns. Pay once.
What you get
7 things security and data does
-
Three things leave your server, and that is all
The emails you send through your own Resend account or SMTP server, the payments going to your own gateways, and a licence check-in twice a day carrying the signed licence and the version you run — no client, order or invoice data.
-
Keys sealed with AES-256-GCM
Gateway, email and storage credentials are encrypted in the database with a secret that exists only on your server, and the docs describe how to rotate it.
-
A least-privilege database login
The API cannot change the schema, and refuses to start as a superuser or as the table owner.
-
Private files behind expiring links
Every file except your logo is private and reached through a signed link that expires — 15 minutes by default.
-
122 permissions and six built-in roles
Owner, ops manager, account manager, writer, outreach and finance, plus roles you build yourself. Clients get their own per-company roles: owner, admin, member and viewer.
-
Two-factor, and an audited "sign in as"
Passwordless sign-in codes, Google sign-in and 2FA that can be required for the whole team. Viewing a client’s portal is read-only, time-limited to 30 minutes, and your reason and every page you open are logged.
-
HTTPS, HSTS and two open ports
Certificates are issued and renewed automatically; only ports 80 and 443 are open; and every release file is checked against its SHA-256 before it is installed.
Where this comes from. Area 11 (Security) and the "Self-hosted, for real" section of getclientos.com, read on 29 October 2026. Check any line of it against that section of getclientos.com/features or the official docs for this area. Nothing on this page adds a capability those pages do not state.
Either way
Runs on your own server
Every feature above runs inside one installation on a Linux VPS you control, on one domain of your own.
- Your database Clients, orders, messages, invoices and files live in your own PostgreSQL.
- One thing leaves it A license check-in twice a day: the signed license and the version you run.
- No per-seat charge Licensed per domain; every package states unlimited clients, staff and orders.
Keep exploring
The other feature areas
Store and checkout
Sell productized services from your own domain: a sales page per service, five pricing models, packages, add-ons, coupons and a checkout that only creates an order once payment clears.
Read moreOrders and delivery
Briefs, statuses, hand-overs, revisions and approvals that auto-close when a client goes quiet — plus a team task board that builds its own cards from orders and tickets.
Read moreInvoicing and finance
Gapless invoice numbering, pay links, partial payments, credit notes and subscriptions that bill themselves — with profit and loss, expenses and margin by service.
Read moreWhite-label
Your domain, five logo slots and two brand colours that repaint the portal, admin, sign-in, emails and invoices. Rename the words clients read. Clients never see ClientOS.
Read moreMessages and help desk
A conversation per client and per order, team channels, priced offers accepted in chat, and a built-in help desk with first-response targets counted in your business hours.
Read moreLeads and growth
Capture leads from your website, work them through a pipeline with source and value, track short links and a funnel to paid, and reward the partners who send you work.
Read moreSelf-hosting
One A record, one command, and ClientOS runs on your own Linux VPS: Docker, PostgreSQL, file storage and automatic HTTPS. Update, back up and roll back with one command each.
Read moreSee it working before you decide anything
The instant demo emails you a login to a live ClientOS — the full agency admin and client portal with sample data. Read-only, so you can click anything. Your login works for 3 days. No call, no card.