---
title: "Portal defaults"
description: "The portal settings that apply to every client, from session timeouts and invitation lifetime to the daily digest and each notification's default delivery."
url: "https://support.outpostplatform.com/client-portal/defaults/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "MSP plan. Settings > Client portal > Defaults: technician names, sign out after idle (30, 5 to 60 minutes), re-ask on sensitive pages (15, 1 to 15 minutes, PCI DSS 8.2.8), longest session (12 hours), invitation links (7 days), daily digest hour, and each notification's default delivery (Right away, In the daily digest, Off; security never off)."
availability:
  plans: ["msp"]
  permission: "clientportal:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/defaults.md"
license: "CC BY 4.0"
---

# Portal defaults

These settings apply to the portal of every client. Change them on
**Settings** > **Client portal** > **Defaults**, then select **Save defaults**.
Reading them needs `clientportal:read`, and changing them needs
`clientportal:manage`.

## Sessions and invitations

| Setting | Default | Range | What it does |
| --- | --- | --- | --- |
| **Technician names** | Technicians by name | | How a client's activity log names your technicians, unless the client is set otherwise. See [Name technicians in the activity log](/client-portal/activity-log/). |
| **Sign out after idle, minutes** | 30 | 5 to 60 | How long a portal session lasts without activity. |
| **Re-ask on sensitive pages after, minutes** | 15 | 1 to 15 | How long without activity before billing, people, remote access, and the person's own sign-in settings ask them to confirm who they are again. PCI DSS 8.2.8 allows at most 15. |
| **Longest session, hours** | 12 | 1 to 12 | The longest a portal session lasts, active or not. |
| **Invitation links work for, days** | 7 | 1 to 30 | How long an invitation stays usable. |
| **Daily digest goes out at** | 8 | | The hour the daily summary email is sent, in each person's own time zone. |

Re-asking on sensitive pages never ends the session. It asks again only after
the person has been idle on those pages.

## Notifications

Each portal user chooses how they hear about each event, from the events
their permissions let them see. Until they choose, they get the default you
set here:

| Delivery | Meaning |
| --- | --- |
| **Right away** | An email for each event. |
| **In the daily digest** | One email a day that groups events from every organization the person belongs to. |
| **Off** | No email. Not available for security notices. |

| Event | Default |
| --- | --- |
| A new invoice is ready | Right away |
| An invoice is due soon | In the daily digest |
| An invoice is overdue | Right away |
| A payment went through | Right away |
| A payment failed | Right away |
| An automatic payment failed | Right away |
| A quote is waiting for a decision | Right away |
| A quote expires soon | In the daily digest |
| An approval is waiting for you | Right away |
| A milestone is ready for sign-off | Right away |
| A ticket was opened | In the daily digest |
| A ticket was updated | In the daily digest |
| A ticket was resolved | In the daily digest |
| A request was completed | Right away |
| Remote access is about to expire | In the daily digest |
| Sign-ins and security changes on your account | Right away, and never off |

Each person hears only about what their permissions let them see. Ticket
emails a person gets as the ticket's requester are sent as before, whatever
these say.

## Ready-made roles

The **Defaults** page lists the five roles every client starts with, for
reference. Change them for one client on that client's **Client portal** tab,
under **Roles**. See
[Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/).

## Related

- [Client portal](/client-portal/)
- [Client portal permissions](/client-portal/permissions/)