Access is earned. Data stays in the workspace.

EquipLead is a private workspace, not an open SaaS. New accounts wait for approval. The field app is behind a session. Cron jobs that touch the database require a server secret.

Application data lives in Postgres (Supabase) with row-level security. Plans and activity are scoped to the signed-in user. Territory assignments constrain what a rep can plan. Owners and admins see coverage; they do not silently impersonate a stop.

Auth is email or Google through Supabase. Sessions live in the browser for the app origin. There is no public API for CRM records. Website demo requests are emailed to the operator. They do not create companies, leads, or plan stops.

Field photos, voice notes, and backups go to private storage buckets. Outbound email is transactional (briefings, plans, demo confirmations), not a newsletter.

This page is an accurate description of the current product, not a SOC 2 brochure. If you need a questionnaire for a security review, request a demo and we will run it as part of the conversation.