Building a Full-Stack Platform for a Home Security Business

The client

Active Protective Systems (APS) is a home security installation company serving Northern Louisiana. The owner spent years in the industry watching customers get overcharged by the big names, so he started APS to deliver professional-grade cameras, alarms, and monitoring at honest prices.

When they came to us, they had no web presence and were managing leads and jobs entirely through text messages and spreadsheets. The ask: a credible public-facing site that would generate leads, and an internal tool that would help a small field team stay organized.

The decision: one codebase, two products

Most agencies would treat these as separate projects: a marketing site and a back-office tool, with separate repos, separate deployments, and separate billing. We decided to build both in a single Next.js codebase sharing the same Supabase project.

The payoff: shared auth, shared database schema, shared design tokens, and a single deployment pipeline. When a user logs in on the marketing site, they're immediately auth-aware in the CRM. When the owner adds a customer record, it flows into the portal they can access without a separate login.

The tradeoff is that the codebase has more moving parts. But for a small-team client who wants everything managed in one place and billed as one retainer, it's the right call.

The marketing site

The public site handles five jobs: establish credibility, capture leads, explain services, run a referral partner program, and let customers review estimates without requiring a login.

The referral program was the most interesting piece to build. Partners apply through a form on the site, get reviewed by the owner, and receive a personal referral code when approved. The approval flow is token-gated (no auth required), which keeps the barrier to entry low while the owner retains full control.

The estimate portal works the same way: customers receive a link with a one-time token that lets them view their estimate, approve it, and request changes. No account required.

Tech stack

The CRM

Click to expand

Dashboard: live KPI cards for leads, jobs, quotes, and monthly revenue

The internal CRM covers the full lifecycle of a security installation job: lead comes in, gets qualified, turns into an estimate, estimate gets approved, job gets scheduled, tech installs the system, invoice goes out, and for monitoring contracts it auto-renews monthly.

A few design decisions that shaped the architecture:

• Multi-tenancy from day one. Even though APS is the only tenant right now, every record is scoped to a business_id enforced by Supabase Row Level Security. This makes the platform portable to any home-service vertical without a rewrite.
• Config-driven document generation. Contracts, estimates, and invoices all pull from a single source of truth. Invoice totals, contract numbers, and line items are calculated once and referenced everywhere. No risk of the PDF and the database showing different numbers.
• Error isolation on the dashboard. Each KPI card fetches independently using Promise.allSettled. If the leads count query fails, the revenue card still loads. Small thing, but the owner sees this page every day.
• Profile cache in middleware. Auth-protected pages were running redundant profile queries on every navigation. A short-lived cookie in middleware caches the result and eliminates the N+1.

What shipped

The platform is live at activeprotectionsystems.com. The owner manages leads, schedules jobs, and sends estimates and invoices from the same tool his team uses in the field. Customers get emailed a link to review and approve their estimate before any work begins.

The referral program went live with three active partners in the first two weeks.

The takeaway

Small service businesses don't need Salesforce. They need something that fits how they actually work: fast to learn, simple to operate, and built around the specific jobs they do every day.

That's what we build at Archix Digital: purpose-built software for the business, not a generic platform forced to fit. If you're running a field-service operation on text messages and spreadsheets, there's a better way.