A Pay-to-Release Report Portal for an Engineering Consultancy

1. 01

   Upload once and let the invoice do the typing

   An engineer drops the Xero invoice and the deliverables onto one page. The portal works out which PDF is the invoice and reads the amount due, the invoice number, the client, the job title and every client email printed on it.

   Text rules do most of the work, because the firm's invoices all come from one Xero template. When the rules cannot find an amount, Claude Haiku reads the invoice instead, including scanned invoices with no text layer. Each file is read once and the result is stored against it. Every AI call is logged with its cost.

   A person still confirms the amount before anything is sent. Fields filled from the invoice are labelled "From invoice" until someone edits them, so it is always clear what the software decided and what a person checked.

   Then the engineer copies the link into their usual email, or sends it from the portal.

   

2. 02

   A DRAFT stamp you cannot inspect away

   The client opens the link and sees what they are paying for: the amount due, the files, and a preview of each report with DRAFT across every page.

   The stamp is applied on the server when the job is saved. The portal reads each page's size and rotation, builds an overlay and merges it into a copy of the PDF. The client's browser only ever receives that copy. A watermark drawn by the browser over the clean file can be removed by anyone who knows where to right-click, so we did not build one.

   Real reports are messy. When a page in a PDF is partly damaged, the stamper keeps the part that reads and still stamps the copy. The original is never touched.

   CAD drawings and Revit models cannot be previewed in a browser, so they show with a padlock until payment. Every file sits in a private Cloudflare R2 bucket. Each preview and download goes through the portal, which checks the job and then issues a link that expires after five minutes.

   

3. 03

   The payment step changed mid-build

   The plan was Stripe on the portal. The client pays by card, a webhook confirms it, the files unlock straight away. Then Australia's ban on card surcharges took effect on 1 October 2026, the same week as the build. Card fees could no longer be passed on to the client, and the firm did not want to absorb them on every invoice.

   So bank transfer became the default. The pay dialog shows the firm's account details with the invoice number as the reference, each with a copy button. After paying, the client clicks "I've paid by bank transfer" and enters the date, the amount and, if they like, a remittance. That emails the firm's accounts inbox and the engineer who sent the link, and puts a notice on the job.

   The notice does not unlock anything. Only a confirmed payment does.

   

4. 04

   Paid in Xero, files released

   The firm's payments are recorded in Xero anyway. A client can pay a Xero invoice by card through Xero's own payment link, and bank transfers are reconciled there. So the portal asks Xero.

   It has a read-only connection to the firm's Xero organisation. When an invoice changes, Xero sends a signed webhook and the portal checks that invoice within seconds. If Xero says it is paid in full, the job unlocks and the client receives an email saying the final files are ready. A check every ten minutes catches anything a webhook missed.

   The webhook itself is never trusted. It only tells the portal which invoice to look up, and the answer always comes from Xero. Anything unclear goes to a person instead: two jobs with the same invoice number, a part payment, a voided invoice or a revoked link. Staff can still click Mark as paid at any time, and if Xero and a person pay the same job at once, it is paid once and the client gets one email.

   

5. 05

   The office view

   The dashboard answers the questions accounts actually ask. How much is waiting on payment? Which links has the client not opened yet? How long are clients taking to pay? Each job keeps a timeline: link created, opened by the client, remittance received, paid in Xero, files-ready email sent.

   Engineers see their own jobs and admins see all of them. Nobody can sign up. Staff join by invitation. Osher has its own view of the Xero connection: the last check, the last webhook, and any job that needs a person.

   

These screens come from a demo account. Every client, job, document and bank detail in them is invented.

The client's link6 screens

On a phone4 screens

The office10 screens