Client Portal
The Client Portal
Signing in
Go to siegepoint.apintelligence.ai/portal and sign in with the email and password issued to your organization. Sessions are cookie-based, expire after 8 hours of inactivity, and are protected in transit (HTTPS-only, secure cookies). Login is rate-limited against brute force.
What you can do
- Review engagements — every engagement with its reference (SP-YYYY-###), client, type, status, and testing window.
- Open an engagement — see scope in/out, knowledge level, environment, and the secure link to your delivered report.
- Run external recon — trigger Mangonel's passive S0–S1 reconnaissance on an authorized engagement; discovered subdomains are then recursively fingerprinted (bounded to the authorized apex by the gate), and the resulting assets and findings appear on the record.
- Track findings — each finding with severity, CVSS, description, business impact, and remediation, plus its status (Open → Remediated → Risk Accepted).
- Follow status — the engagement lifecycle from Scoping through Delivered and Closed.
Roles & access
The portal enforces two roles. An admin (SiegePoint staff) manages engagements, findings, external recon, and user accounts. A client account is scoped to a single organization and gets a read-only view of only that organization's engagements — its scope, status, discovered assets, findings, and the secure report link. A client cannot see another client's engagements (they return "not found"), cannot create or edit records, and cannot reach the user-management or audit pages. Forms are CSRF-protected and all input is validated and escaped.
Action audit log
Every security-relevant action — sign-in (success and failure), sign-out, engagement create/update, finding add and status change, external-recon run, and user creation — is written to an append-only audit log visible to admins. Records are hash-chained with SHA-256: each entry commits to the one before it, so any later edit or deletion breaks the chain and is flagged on the audit page. The log records the actor, action, target, a short detail, source IP, and UTC timestamp.