Can vendors or clients accidentally see data they shouldn’t?

No. Vendor portals and client portals are completely separate environments built into the architecture. Vendors see only their own tasks, POs, and invoices. Clients see only their own projects and invoices. Neither can see your internal margins, other clients' data, or other vendors' rates.