Falaah Falaah AI

External Reviewer Access

Give an auditor, insurer, board reviewer or certifier scoped read-only access through a short-lived link, without adding them to your team or giving them a password.

Outside reviewers get a link, not an account. The link carries what they may see, it expires, and it never becomes a login.

When you’d use this

  • An external auditor is examining one compliance framework and needs the evidence for it.
  • Your insurer’s underwriter wants certificates, incidents and inspections before renewal.
  • Your board has to vote on a grant round and the members do not have Muin accounts.
  • A funder asked for proof that your staff and vendors hold current certifications.

The auditor portal

  1. Invite the auditor from the compliance framework they are auditing. Muin emails them a magic link.
  2. They open it at /auditor/{framework}. The invitation in the URL is exchanged once for a short-lived credential held only for the life of that browser tab, and the token is cleared from the address bar immediately. It is never stored on their device.
  3. Their workspace has four tabs: Overview, Controls, Evidence and Submit Finding.
  4. When they are done they select Finalize audit.

The link is scoped to one framework. An auditor invited for one framework cannot reach another, and the scope is enforced on the server, not just hidden in the interface.

For a grant audit, share one award instead: open it under Received Grants and choose Share with an auditor. The auditor opens a read-only page for that award at /auditor/pack/{grant}. With Grant Procurement Compliance it can include the award’s procurement records. The auditor can record findings, which reach you as tasks, and sign off; a procurement record that changes after sign-off notifies them. See Grants.

An insurer link uses the same portal with a different, non-overlapping set of sections: Certificates, Incidents and Inspections. An insurer link is not an auditor view with tabs removed; the two scopes are separate by design.

  1. Prepare a grant review package in the Nonprofits module.
  2. Muin issues a board-review link of the form /board-review/{token}. Board members open it with no sign-in.
  3. Each member sees the package’s executive summary and one card per application, showing the Organization, Contact, Project Description, Expected Outcomes, the requested amount and the Staff Evaluation.
  4. They vote and leave comments directly on each card.

The link is tied to the package. Issue a new package and the old link stops being useful.

Certifications

The register a reviewer is usually asking about.

  1. Go to Certifications in the sidebar (/certifications). Owners and admins only.
  2. Summary cards count Total, Valid, Expiring Soon, Expired, Missing, and the overall Compliance Rate.
  3. The table lists each certification with its Entity, Type / Source, the certification itself, its Expires date, Status and whether it is Verified.
  4. Filter by type (Employees, Vendors, Contractors), by status, or by source (HR Module, Vendor Module), or search by name or certification. Reset Filters clears everything.
  5. Export CSV produces the file to hand over.

Certifications are not created here. They are added in the HR or Vendor modules, and this screen is the unified read across both. The empty state says so and offers Go to HR Certifications and Go to Vendor Compliance.

What it affects

  • An external link grants read access to the scope it carries, for as long as it is valid. It creates no team member, no role and no password.
  • A finalized audit is recorded against the framework and appears in your compliance history.
  • Board votes and comments are written to the review package and are visible to your staff.
  • Nothing a reviewer does changes your records other than their own findings, votes and comments.

When it goes wrong

What you see What to do
The auditor says the link does not work Invitations are short-lived and single-use. Send a fresh invitation from the framework.
The auditor sees the wrong framework They were invited against that framework. Invite them to the right one; scope is enforced server-side and cannot be widened by the link.
The auditor lost the tab and is now signed out That is the design: the credential lives only for the tab. Send a new invitation.
“Could not load certification summary: counts may be stale.” Reload. Treat the counts as unknown, not as clear.
“We couldn’t connect to the server. Please check your connection and try again.” Reload. Nothing was exported or changed.
“No certifications match your current filters.” Select Clear Filters and widen the search.
“Start tracking certifications by adding them in the HR or Vendor modules.” There are none yet. Add them in HR or Vendors; they cannot be created on this screen.

Next step