Forum

The forum is your site's public discussion board. Anyone who can see the site can read it; writing belongs to your signed-in customers — the same customer accounts the portal uses. Staff answer and moderate from the backoffice.

Off until you turn it on

A new organization has no forum. The switch lives at the top of Commerce → Forum: until you enable it, the /forum address on your web is a plain 404.

WHY: a board nobody asked for must not appear on anybody's web — an empty, unmoderated forum is worse than none.

Enabling the forum seeds one General category so the board is never an empty shell. Categories are yours to shape: machine name, label, description, weight and an active flag. A category that still has topics refuses deletion — move or delete the topics first.

Who may write

Reading is public. Writing requires a signed-in customer of your organization — a person with live portal access. The forum deliberately adds no identity of its own:

• If you want an open forum, open your portal registration mode — anyone may register, and every registrant may post.
• If you want a customers-only forum, keep registration on approval or invitation. The forum inherits that door automatically.

A visitor without an account sees the whole board and a sign-in invitation where the forms would be.

Topics and posts are append-only

A topic is a title and its opening post; replies follow in order. Nobody — not even staff — edits a published word: moderation hides or locks, it never rewrites. A public thread that can be edited after the fact is a record of nothing.

• Hide a post or a whole topic — it stays in the database (the trail records who hid it and when) and vanishes from the web.
• Lock a topic — reading stays open, new replies are refused. Staff may still add closing words under a lock.
• Pin a topic — it stays on top of the board.
• Delete — staff may remove spam outright; the activity trail keeps the fact that it existed.

Posts are plain text with line breaks. There is deliberately no rich text, no images and no attachments in the first cut.

Keeping the bots and the flood out

Three gates guard the posting doors, in this order:

1. Portal sign-in — an anonymous POST is refused.
2. Honeypot — the same hidden-field-plus-timestamp trap every public form on the platform carries.
3. Flood window — one customer may write at most N topics + posts in M minutes. Both numbers are configuration on the Forum screen (default 10 in 10 minutes); staff replies are never throttled.

If your firm has the Cloudflare human check (Turnstile) enabled, the posting forms carry it too, verified server-side like every auth door.

Moderation is on the record

Every moderation act — hide, restore, lock, unlock, pin, unpin, delete — lands in the topic's activity trail with the actor and the time. Moderation without a record is censorship nobody can audit.

Privacy

Forum posts are personal data of their authors. The GDPR module knows the forum as a source: a data-subject export includes the person's topics and posts; an erasure anonymizes their authorship — the account link and the name snapshot go, the text stays as your firm's record (remove text with moderation). A deleted customer account never takes the thread down with it: the author name was snapshotted at posting time.

Everything is per organization

Settings, categories, topics and posts belong to one organization. Another firm's web shows nothing of yours — there is no shared board, no shared category, ever.

Claudia

The assistant carries the moderator's toolset: reading the board, saving and deleting categories, replying as staff, pinning, locking, hiding and deleting — behind the same manage_forum permission as this screen.