Tenant separation
Business records are scoped to their business tenant and database access is protected using permission-aware policies.
Locksmithy's public pages are deliberately separated from operational records. Product examples use demonstration data and are not connected to customer, payment, staff, vehicle or stock records from a live business.
Security is treated as part of the workflow rather than a marketing afterthought.
Business records are scoped to their business tenant and database access is protected using permission-aware policies.
Operational modules and high-impact actions can be limited to staff with the appropriate role or permission.
Credentials such as Xero client secrets and other private provider keys are kept in server-side function secrets rather than public browser code.
Invoice export uses an administrator review queue, while corrected payments retain reversal history instead of silently deleting the audit record.
Customer-facing documents and private business files use controlled application workflows instead of being published as marketing assets.
Public showcases should use the dedicated demo environment or fictional sample records, never screenshots containing production information.
Public product material should not expose real customer names, addresses, phone numbers, emails, invoice details, payment references, vehicle registrations, stock levels, supplier account data, staff information, API credentials or internal security configuration.
The dedicated Showcase page is designed to be safe to share publicly.
VIEW THE SHOWCASE