Proven in testing, not live yet
Each firm's records are kept apart.
One firm cannot read, change or remove another firm's records, or its set-up.
A test made 603 tries as one firm to reach another firm's records. None got through.
Where it is proven test_6005_no_firm_reaches_another and test_6003_setup_tenant_rights_and_limits, written up in docs/handoff/2026-11-11-crm-hardening-proof.md
Proven in testing, not live yet
A list taken off keeps its records.
Take a list off the menu and every record in it is kept, so it can be put back.
A list or a stage that still holds records cannot just be deleted. The list is put away instead, and the stage asks where its records move first.
You can try this today in the builder, on sample records.
Where it is proven test_6003_setup_agrees_with_setupdiff, written up in docs/handoff/2026-11-11-crm-db-proof.md. Putting a list back: tools/solar/rules/test/setup-talk.test.mjs
Proven in testing, not live yet
Every set-up change can be undone.
Each change you save to your lists, stages and fields is kept as a version. Undo puts the one before back, and the newest 20 versions are kept.
Where it is proven test_6003_setup_versions_and_undo, written up in docs/handoff/2026-11-11-crm-db-proof.md
Proven in testing, not live yet
A removed record is put aside first.
Removing a record takes it off your lists at once. It is kept, marked removed, until it is cleared for good.
How long it is kept, and the timer that clears it, are in build.
Where it is proven test_6005_remove_forget_and_purge, written up in docs/handoff/2026-11-11-crm-hardening-proof.md
Proven in testing, not live yet
Erasing one person's details.
Erase one person, and every record holding their email address or phone number loses its answers. Their entry on your customer list is erased in the same step.
It can count what it will touch before anything changes. Each record stays, named "Erased person", with its money and dates. The note kept of the erase holds no name, address or number.
A live firm cannot press it yet.
Where it is proven test_6007_erase_is_counted_complete_and_recorded and test_6005_remove_forget_and_purge, written up in docs/handoff/2026-11-11-crm-records-live-proof.md
Proven in testing, not live yet
A saved design lasts 30 days.
When saving is switched on, a design is kept by a link and deleted 30 days after it was saved. A link that old no longer opens.
A design holds your trade, your set-up, a business name and a colour. There is no place in it for a person's name, email or phone. We keep a one-way fingerprint of the link's key, never the key itself, so a copy of our table opens nothing.
It may stay in the database's nightly backup copies for up to 31 days after it is deleted. Saving is switched off on this site today.
Where it is proven test_6006_thirty_days, test_6006_drafts_are_dark and test_6006_only_a_good_row_goes_in, written up in docs/handoff/2026-11-11-crm-drafts-proof.md. The backup copies: tools/hq2/migrate-p6006-crm-drafts.sql
