A planner can create an appointment link. The customer opens it without an account and sees only that appointment: title, date, local time or arrival window, visit address and an arrival estimate when one is known. An unknown arrival time stays unknown. This is not a live map of the technician’s location. Under Planning, Day proposal, Planning rules you can turn on, per workspace, that the technician's first name appears on the page. It is off by default, and the technician's surname, address and location are never shown.
Customers can confirm the appointment, send a message, request another time or report that they will not be at home. The response states what has been recorded. A request never reschedules or cancels the appointment automatically. The planner reads it under Customer contact, checks availability and deliberately applies any new time through the existing appointment form. They can then mark the request as handled or reject it. Confirming an appointment does not sign off any work.
Signing becomes available after the technician has arrived on a confirmed route. The customer first sees the exact receipt statement and enters their name and signature. They can draw in the signature field or choose a PNG image. The signature confirms only the displayed receipt statement for this appointment. It does not approve the job sheet, workmanship, quote, price or invoice. If the appointment version or content changes, the page must be reloaded; old content cannot be signed silently.
A new appointment link replaces the previous one. Revocation or expiry closes access. Share a link only with its intended recipient: anyone holding it can open that appointment. Stored tokens are hashes. The page is excluded from search engines, does not pass the token in a referrer and uses a shared database request limit. Simply opening the page confirms or changes nothing.
Preparing an email sends nothing. The planner reviews the existing email layout and then requests a human R3 signature under To sign. At execution, current consent, recipient, appointment, content and brand are checked again. A changed source blocks sending. This also applies to existing appointment confirmations and reminders. SMS and WhatsApp are unavailable in this phase.
The relationship portal also shows a limited list of the customer’s appointments and files explicitly shared by a team member. Photos and signatures attached to a stop do not become visible automatically. See Customer portal and shared files.
Sharing an item with a customer
An item is internal until someone with the right to share (owner and administrator) chooses otherwise. The item has a Share block with four settings:
- Internal: only the team sees the item. This is the default.
- Customer can view: the contacts of the project's customer see the item in their customer portal. They cannot change anything.
- Customer can reply: the customer can also send a reply (1 to 2000 characters, at most five per item per day). You see the replies in the item, as plain text.
- Anyone with the link: a link that works for 90 days and shows the item to whoever has it, without logging in. You see the link once, right after sharing; after that it cannot be retrieved, because only a fingerprint is stored. The link is not tied to a person. Whoever forwards it shares the item.
Choosing a setting that goes outside only takes effect after a confirmation, which says what the other person does and does not see. Going back to internal, or to a lower setting, is always immediate and also withdraws a link at once. Making a new link switches the old one off.
What the customer sees: the title, whether the item is done, and the description as text (without formatting, images or links). What the customer never sees: comments, the history, attachments, points, risk, hours, labels, names of colleagues, the crew and what the director proposed. An item labelled internal, payment, privacy or legal never goes outside. If you change the title or description later, the customer sees that too; sharing follows the item.
In a trial you cannot share anything. A key (MCP) can withdraw, but it only proposes sharing outside: a person signs that under Approvals. Only a person can make a link, in the screen.