White-Label Client Portal Checklist: Test Before Buying

Which parts of the portal carry your brand?

White-label is a scope to verify, not a complete feature specification.

Start with the surfaces a client actually encounters. Invitation emails, sign-in, password recovery, the signed-in workspace and downloaded reports may have different branding rules. A white-label coaching platform can support your logo inside the workspace without removing the software provider's identity everywhere else.

For MentPass, the September 2026 public product description and pricing information specify practice name, short name, logo and primary colour in the signed-in workspace on every plan. On Pro and Scale, the client portal can run on your own domain (3 custom portal hostnames on Pro, 12 on Scale) and email can be sent from your own domain once the DNS records are verified. The login page keeps MentPass branding. Treat those as explicit boundaries, not details to discover after promising a fully private-labelled experience to a client.

Include the external handoffs in your own description of the service. MentPass uses native Google Calendar sync and your TidyCal, Calendly or Cal.com booking link. On Pro and Scale, supported Fathom or Fireflies plans provide meeting imports; MentPass does not record calls. A consistent portal does not make those separate services disappear.

Can a client complete the work without your help?

A branded workspace still fails if the client cannot complete the next task.

Run one complete fictional engagement instead of clicking through a prepared dashboard. Invite the client, open the invitation on a phone, sign in, find the latest session record and respond to an action. Then return a day later and locate the unfinished work. Note every point where you need the vendor to explain what happens next.

Test keyboard use, visible focus, readable text at increased zoom and sensible error messages. The W3C accessible authentication guidance, reviewed in September 2026, identifies password-manager support and copy-and-paste as ways to reduce authentication barriers. Check these on the real sign-in and recovery screens, not only in an accessibility statement.

Brand colours also need checking. A pale accent that looks good on a logo may make button text unreadable. Ask what contrast protection the product provides and test the actual combination you intend to use. A brief trial is useful evidence of usability, but it is not a full accessibility audit or a conformance certificate.

Write down the client's essential tasks before scoring the portal. For an independent mentor, client progress tracking may require reading session context and accepting the next action, not browsing a resource library. The coaching client portal guide helps define the working experience; this checklist tests whether a shortlisted product delivers it.

Are permissions real or merely hidden menus?

Removing a link from view is not the same as denying access.

Ask the vendor to demonstrate role boundaries in a test environment using fictional accounts you are authorised to access. A client should see their own permitted records, not another client's files. An assistant should receive only the access required for their job. Do not test another customer's account or attempt intrusive security checks without explicit permission.

The OWASP Authorisation Cheat Sheet, checked in September 2026, distinguishes authentication from authorisation and recommends permission checks on every request. For a buying decision, ask for evidence that files, shared links and exports follow the same access rules as the main workspace. A successful login proves identity, not entitlement to every record.

1. Create a role inventory: mentor, client and any support role the product actually offers. Ask the vendor to mark unsupported roles explicitly.
2. Check a fictional record as each authorised test user. Include private notes and shared resources if those features exist.
3. Demonstrate removal of access. Confirm what happens to active sessions, shared links and downloads after removal.
4. Ask who can grant access, restore an account and produce an export. Record any vendor-assisted step and its identity checks.

Do not infer private-note separation from a label alone. Ask whether a field is private to you, visible to other practice staff or included in a client export. Where the interface cannot express your confidentiality agreement, change the workflow or choose different software.

What can you retrieve when the relationship ends?

Test the exported record before trusting the exit promise.

Request a sample containing a fictional client, one session and several actions with different statuses. Add an attachment. Check whether the downloaded records keep the relationships between those objects, or whether you receive disconnected files that require manual reconstruction. A screenshot of an export button cannot answer that question.

For UK GDPR arrangements, the ICO's processor-contract guidance, checked in September 2026, covers end-of-contract return or deletion of personal data, subject to applicable retention requirements. The page is under review following legislative changes. Check the current contract and obtain advice for your jurisdiction where needed; a vendor's marketing wording is not a substitute.

The ICO's data portability guidance, also checked in September 2026, describes a conditional right for individuals, not a promise that your entire business database will migrate. Ask separately about notes, attachments and record relationships. Specify the business export you need instead of relying on the word portability.

MentPass's current description distinguishes direct file downloads from other workspace data packaged for export on request. Do not describe that as an instant self-service export of everything. Ask for the current package contents and process, then test whether they preserve the records your practice needs.

How should you make the buying decision?

A failed must-have should not disappear inside an average score.

Separate buying conditions from preferences. Client access boundaries and an acceptable exit process may be conditions. A particular email footer or logo position may be a preference. If a custom domain is genuinely contractual for your practice, a portal without one is not a fit, even when its remaining features are attractive.

Keep the vendor's answer, the test date and the tested plan together. Separate 'demonstrated', 'documented but untested' and 'not available'. A feature promised for later belongs in the last category for today's purchase. Repeat the most important tests before expanding from a trial to active client records.

Finally, include external subscriptions and handover effort in your practice management software evaluation. For a shortlist that includes those products, use the MentPass vs Simply.Coach comparison to frame questions, then run these tests against the current plans. The useful choice is the service whose documented limits match the experience you can honestly sell and operate.