Trust & Security

The Head On Marketing ERP is an internal tool. Access is restricted to authenticated staff accounts provisioned by a Head On administrator. There is no public self-signup or anonymous access to business data.

Staff sign in with email and password. Password reset is delivered by email through the backend auth provider. Sessions are managed by the backend; signing out clears the session in the browser.

Roles (sales director, sales manager, designer, engineer, business development executive, data entry executive) are stored server-side in a dedicated roles table and enforced on every request through database row-level security policies and server-side role checks. Client-side role hints are never trusted on their own.

The application runs on the Lovable platform with a managed Postgres backend, managed authentication, and managed file storage. Lovable provides the underlying platform capabilities; Head On is responsible for how this ERP is configured, who is granted access, and what data is entered into it. This is a shared-responsibility model.

The ERP stores business data that staff enter while doing their work: leads and contact details, quotes, sales orders, design jobs and related files, activities, notifications, and target/performance figures. It also stores the email address and display name of each staff user.

Uploaded files (signatures, job-card drawings, design files) are kept in private storage buckets. They are not publicly listable. Access is granted only to the staff roles that need it for their work, enforced by storage-level policies.

All traffic between the browser and the application is served over HTTPS.

The application relies on the Lovable platform (hosting, database, authentication, file storage) to operate. Additional third-party services may be added over time; Head On administrators are responsible for keeping this list current for their customers and partners on request.

Business records are retained for as long as they are useful to Head On's operations. Lead deletion goes through an in-app request and approval workflow handled by sales leadership. For deletion of a specific record or a staff account, contact a Head On administrator.

If you believe you have found a security issue in the Head On Marketing ERP, please contact a Head On administrator directly so it can be triaged and addressed.