How do agencies keep one client's report from reaching another?

Publish private by default and widen deliberately per report, so a link is never live before someone decides it should be. Teams and folders give each client its own container, and domain-gated visibility restricts opening to verified email domains — both Enterprise.

Can reports be served from our own domain?

Yes, on Enterprise — a custom domain such as reports.youragency.com, with the 'Published on Comma' mark removed. On Free the report renders your HTML and branding, but the URL is on commareports.com.

Do client contacts need accounts?

No, and they are never billed. Pricing is per publisher — the people at the agency who create reports — so adding a client's whole marketing team as readers costs nothing.

Can the monthly report generate itself?

Yes. A routine runs on a schedule, regenerates the report and updates the same URL, so each client bookmarks one address instead of hunting for this month's email.

What happens when an engagement ends?

Set the report back to private and the link stops working immediately. The revision history stays with you, which matters when a former client asks what was delivered in March.

Many clients, one workspace

An agency's reporting problem is not producing the report. It's that you produce twelve of them, every month, for twelve organisations that must never see each other's — and the whole system is held together by people pasting the right link into the right Slack channel.

That works until the day it doesn't.

Separation that isn't vigilance

The reliable version has three properties, in this order:

Nothing is live until someone decides it is. Reports created over the API start private. A generated report is not a published report, so a script that runs at 3am can't expose anything.
Each client is a container, not a naming convention. Teams and folders (Enterprise) give client work its own home, so "Acme — September" is not sitting one row above "Acme's competitor — September" in a flat list.
Access is checked server-side. Domain-gated visibility (Enterprise) means only verified @client.com emails can open, with no per-viewer invites to maintain and no seats to buy. Pairs with SSO and SCIM if the agency is on an identity provider.

The full model — five visibility levels, link permissions, per-person roles — is in sharing & access control.

The monthly report, automated

Retained client reporting is the same job every month, which makes it a routine: a schedule, a generation step, and an update to the report that already exists.

Every first Monday, rebuild the Acme performance report from last month's
data and publish it as a revision of report acme-monthly — do not create
a new report. Then post the URL to the #acme channel.

Because the revision lands at the same address, the client bookmarks one URL in January and it is still the current report in November. Nobody searches their inbox for "September report final".

What clients actually get

A URL that opens in the browser they have. No account, no extension, no PDF conversion, no "it says the file is unsafe."

Whatever you built stays intact: a Lighthouse audit keeps its expandable diagnostics, a Looker Studio or Metabase export keeps its tables, a Plotly chart keeps its tooltips. Scripts run in a sandboxed iframe, so interactive means interactive.

And when the client's head of marketing replies, they reply on the number — an anchored comment on the row they're questioning, not a paragraph of email that you have to map back to a table.

White-labelling, honestly

Always yours: the report's HTML, CSS, logo, layout, typography. The page is your artifact.
Enterprise: custom domain (reports.youragency.com), no "Published on Comma" mark, password-protected and expiring links, audit log, IP allowlist, on-prem.
Never: a per-client theme applied by Comma to your content. If you want the client's brand on it, put it in the HTML you publish — which you were doing anyway.

Worth knowing

Viewers are free, forever. Adding forty client-side readers costs nothing. Seat-based portals charge for exactly this.
One report per deliverable. Revisions are the version history. Filenames are not.
Keep archives private, not deleted. A closed engagement that might be referenced later is worth more as a private report with its comment trail than as a zip in Drive.
Limits. Entry HTML 5 MB; assets 25 MB per file, 250 MB and 500 files per report.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history. Client readers are never charged.

Start free → · Talk about Enterprise →