By default the portal link is the key: whoever holds it can open the page. That is deliberate — it is what makes the portal work for a client who will not create an account.

For a client where that is not enough, Portal access adds a second step: Require an access code to open the portal. They enter six digits before the page opens.

You hand over the code, not Vylan

This is the part worth understanding, and the app says it on screen: Give the code to your client yourself — by phone or in person. Vylan never sends it, because a code emailed beside the link would protect nothing.

A code that arrives in the same inbox as the link is not a second factor. It is a second line in the same email. So Vylan will not send it, and you tell them.

Working with the code

• Show code and Hide code — it stays hidden until you ask.
• Copy code — for reading out, or pasting into a message you are already writing.
• Regenerate — issue a new one.

Regenerating is not free: This invalidates the current code on all devices. Anyone already through the gate will have to enter the new one. Use it when a code has gone somewhere it should not have, not to tidy up.

What it does and does not cover

It gates the portal page. It is not a general permission system, and it does not protect anything you send that client by other means — an email attachment is still an email attachment.

Wrong codes are limited rather than endless: the page counts attempts down and then makes them wait. You will not see that from your side — there is no screen telling you a client is locked out or how many tries they have left. If somebody says they cannot get in, regenerate and read them the new code.