Onboarding contractors without exposing client data

Bringing on a contractor should take ten minutes and expose nothing. Too often it does the opposite: someone invites a freelancer with full access "to keep it simple," and now an external person can browse your entire client roster, see what you charge, and read invoices that were never meant for them. This is a how-to for onboarding contractors the safe way — a checklist you can run every time, built around the principle that a freelancer should see exactly their project and nothing else.

Before you invite anyone

Decide two things first: which project they're working on, and what they need to see to do it. Almost always the answer is "this one project, and the deliverables and time tracking inside it." Write that down before you send an invite, because the default human instinct under deadline pressure is to over-grant.

• The single project (or projects) they'll touch.

• Their rate — which you'll set as a project-member rate so it overrides everything else.

• How they'll get paid: which of the six payment rails they prefer.

Invite them as a contractor

When you add the person, choose the contractor role — not member, not admin. This is the load-bearing decision in the whole process. A contractor in Kliently sees only their own projects and their own time, and never sees client lists, margins, or invoices. The wall is enforced by Postgres row-level security at the data layer, so there's no clever URL or hidden screen that gets them around it.

1. Open the project, add the person, and set their role to contractor.

2. Add them only to the specific project — don't grant workspace-wide access.

3. Set their pay rate as the project-member rate for that project.

4. Send the invite; they accept and land directly in their scoped view.

Why their rate stays invisible

Agencies live on the spread between what they pay and what they bill, and you don't want that number on a contractor's screen. Kliently's rate hierarchy lets a project-member rate override the project rate and your default rate, and it snapshots the rate at the moment each entry is logged — so if you renegotiate later, past entries keep their original value. Because contractors can't see other rates, the margin, or the client invoice, you can pay $50/hour against a $130/hour client rate and the freelancer simply sees their own time at their own rate.

A contractor should be able to do excellent work and still have no idea what you charge for it. That's the point.

Tracking their time cleanly

Contractors track time the same way your team does, against the project they're on. Kliently runs one timer per workspace per user with realtime cross-device sync, so a freelancer can start a timer on a laptop and stop it from a phone. When the work is done, that unbilled time converts into a draft invoice in one click — one line per entry, hours and rates pre-filled — but the contractor never touches or sees that invoice. They produce the time; you handle the billing. See how the timer-to-invoice handoff works in time tracking.

Paying them

Money flows to your own accounts in Kliently — you connect your own Stripe, PayPal, Wise, and the regional rails — so paying a contractor is simply a matter of using whichever rail suits them. For a freelancer in Bangladesh that might be bKash or Nagad via SSLCommerz; in India, UPI through Razorpay; elsewhere, Wise or PayPal. With 18 currencies synced daily, you can keep contractor pay and client billing in different currencies without doing mental arithmetic.

When the project ends

Offboarding is as important as onboarding, and it's where access tends to quietly linger. The moment a contractor's work wraps, disable their access — their logged time entries stay intact for your records and invoicing, but they can no longer open the project. Every grant and revoke is written to the append-only audit log, so you always have a defensible record of who had access and when. For how contractor permissions sit alongside the other roles, read roles & permissions for agencies.

• Disable the contractor's access as soon as the work is delivered.

• Their time entries remain for invoicing and history.

• Confirm the revoke appears in the audit log.