MaiaHub

A lead-capture CRM, multi-office, in daily use

maiahub.hei.dev.br

A client-acquisition CRM used every day by a social-security law firm. Each registered office keeps its own leads, referrers and users, isolated from every other office.

The problem

Acquisition lived in spreadsheets and WhatsApp threads: no reliable history, no sense of where each contact stalled, and no way for a second office to use the same tool without the datasets bleeding together. The client had one specific and fair fear, a data leak, and it drove most of the technical decisions.

The solution

An office registry sitting above the lead registry, tracking where each referral came from and following the lead until it converts. A user can be granted temporary access to another office, and a single lead can be shared with a partner office, without any of that opening up the whole base.

How it was built

Authorization in three layers. Middleware blocks any route without a valid session and revalidates the token against the server on every request instead of trusting the local cookie. Each API route checks again whether the user is still active, so deactivating someone cuts access immediately, even with a session still open in their browser. And Postgres RLS is the last line: even with a bug in a route, the database refuses the query. Sessions live in httpOnly cookies, never in localStorage, and no client-identifying data travels in the URL.

Stack

Next.js
TypeScript
Supabase
PostgreSQL
Tailwind CSS
Vercel

In production: A social-security law firm
Isolation: RLS scoped by escritorio_id