Resources can be public (anyone on the internet can see them) or internal (only logged-in users with the right audience). Choosing the right setting is the key to balancing useful sharing with appropriate privacy.
The audience options
Every resource (and category) has an Audience setting. The options:
| Audience | Who can see |
|---|---|
| Public | Anyone with the URL — no login required. Indexed by search engines. |
| Parents | Logged-in parents at the school. |
| Students | Logged-in students. |
| Staff | Logged-in staff. |
| Specific group | Members of a configured access group. |
You can pick more than one — e.g. Parents + Staff makes a resource visible to both audiences but not to students or the public.
When to use Public
Public resources are useful for:
- School handbook, term dates and other documents you want prospective families to see.
- Policies that are openly published as part of compliance (privacy policy, anti-bullying policy).
- Marketing materials.
- Generic forms (prospectus enquiry, open day RSVP).
Public resources are accessible at a permalink that anyone with the URL can hit. They’re also indexed by search engines — useful for the school’s web presence but not appropriate for personal information.
When to use Parents or Students
Use these audience-specific settings for:
- Year-level handbooks where you want parents/students to read but don’t need the public to see.
- Forms specific to current families (e.g. permission slips, school newsletters archive).
- Internal contact details (e.g. who’s the year coordinator for Year 7?).
The resource is hidden from logged-out users and from users in the wrong audience (e.g. students can’t see parent-targeted resources).
When to use Staff
Use Staff for:
- Internal policies (staff handbook, child-safety procedures, complaints handling).
- Curriculum documents.
- Templates for use only by staff.
- Strategic plans, financial documents.
If a resource contains anything that shouldn’t be seen by parents or students, Staff is the right audience.
When to use Specific Group
For tight targeting, use a specific access group:
- Maths Department for maths-specific curriculum docs.
- Boarding Staff for boarding-house procedures.
- Year Coordinators for year-level coordination resources.
Set up access groups in the main PortalHQ permission area.
How audience flows from category to resource
If a category has an audience restriction, every resource inside inherits that restriction. The most restrictive of (category audience, resource audience) wins.
Practical implications:
- A Staff Policies category set to Staff — every resource inside is staff-only regardless of individual resource setting.
- A category with no audience restriction — each resource’s setting applies.
For tight buckets, set audience at category level. For mixed buckets, set per-resource.
Auditing
A periodic audit of public resources is essential. Ask:
- Does this still need to be public? Resources can drift — what was public in 2020 may have personal data added in updates that shouldn’t be public now.
- Is this the most up-to-date version? Old public resources are findable for a long time.
- Is the audience setting still correct? Staff who’ve left, students who’ve graduated — restrictions need to keep pace.
Set an annual review reminder for the public-marked resources at minimum.
Public URLs
Public resources are accessible via a stable URL. Two patterns:
- Resource permalink —
/resources/<resource-id>/public/— works for any resource set to Public. - Direct download —
/resources/<resource-id>/download/— downloads the file directly.
Share these URLs externally; they bypass the PortalHQ login.
What public users see
Public users see only the resource itself — title, description and file/URL. They don’t see:
- The PortalHQ navigation.
- Other resources or categories.
- Any internal-only content.
It’s a focused, single-resource view designed for sharing.
Tips
- Default to private. Set new resources to Staff (or appropriate audience) and only loosen to public when you’ve confirmed it’s appropriate.
- Be careful with categories. A category set to public makes everything inside public.
- Watch for embedded personal data. A Staff document with personal student data is fine; the same document made public is a compliance issue.
- Public URLs don’t expire. Once you share a public URL, assume it’ll be cached forever. If you publish something publicly, treat the act as permanent.