Zero-Friction PIN access vs. overloaded onboarding
- PROBLEM
Standard B2B onboarding assumes accounts: a password to store, an email to verify, roles to provision, a reset flow to maintain. For an asynchronous client portal, that ceremony is pure drag — every gate between a client and their task costs activation on our side and patience on theirs.
Worse, each account is a standing liability: a credential to leak, a surface to attack, a support ticket waiting to be filed.
- ARCHITECTURE
We removed the account entirely. Access is a personal link plus a numeric PIN — no registration, no password store, no reset flows. Every session is isolated by construction; there is no shared identity surface to compromise.
PIN entropy and lockout thresholds are tuned to a fixed brute-force ceiling — enough to make automated guessing uneconomical without adding a single step the client can feel.
- MODEL
Access is licensed at a flat yearly rate — not per seat, not per month. Monthly billing quietly rewards us for the client's churn-anxiety and penalises them for scaling usage. A flat annual line item removes the meter: we are paid for the system running, not for the client logging in.
- RESULT
Onboarding collapsed from a multi-step account setup to a single screen. Client-side activation dropped to under 20 seconds; access-related support load fell to effectively zero. The engine has run unattended since deployment.
[ Mechanics shown · figures redacted under client NDA ]