Lead Manager
Sign In
Lead Manager Production Suite v1.4.0-dev

Enterprise Lead Operations.
Rebuilt for Resellers.

Deploy a white-labeled, multi-tenant lead intake engine. Give every customer an isolated Postgres database automatically, managed from a single central control plane.

Open Workspace Run Router Sandbox
Lead Manager Analytical Workspace Dashboard showing lead volumes, conversion rates, and acquisition pipeline metrics
Core Architecture

Designed for Complete Data Sovereignty

Keep tenant databases separated physically on shared clusters to isolate client data, backup segments, and custom configurations with zero crossover.

Automated Tenant Provisioning

Onboard clients dynamically. The system provisions schemas, configures Route53 DNS rules, maps connection strings, and initializes first-user authentication.

Database-Per-Tenant Isolation

Ensure robust compliance boundaries. No shared tables or mixed rows. Each tenant works on their isolated Postgres database with credentials encrypted in AWS Secrets Manager.

High-Availability Ingress

Ingest leads via public endpoints with Turnstile bot checks, CORS host restrictions, and configurable notification webhooks to feed external CRMs instantly.

White-Label Vanity Domains

Support custom customer domains. The platform coordinates with ACM for automatic SSL certificate issuance and tracks validation records seamlessly.

Secure S3 Asset Prefixes

Uploads, exports, and audio call recordings are segregated. S3 storage references resolve dynamically at runtime through authorized tenant JWT parameters.

Unified Control Plane

Manage subscription structures, review platform audit logs, and trigger migrations fanning out to databases automatically, completely isolated from customer views.

Interactive Playground

See Routing & Isolation in Action

Interact with our routing simulation to understand how Lead Manager parses incoming traffic and matches it to isolated tenant resources at runtime.

Trigger a Mock Lead Ingress

Fill out this mock contact form to simulate an API request hitting our intake endpoint. The terminal on the right logs each routing step in real time.

bash - lead-ingress-sim.sh
$ curl -X POST https://api.sandbox-corp.leadmanager.cloud/api/v1/leads \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "John Doe", "phone": "+1555019283", "email": "john@example.com", "source": "marketing", "notes": "landing page form"}'
System idle. Submit the form to trace lead resolution...

Tenant Domain Resolvers

Select how a tenant accesses the API. Watch the flow diagram dynamically map variables, perform Platform DB lookups, and load isolated connections.

Host Mapping Rule

Lead Manager resolves the tenant ID dynamically at the Load Balancer level using platform caching, so you do not have to rebuild routing nodes for new clients.

Subdomain Match: *.leadmanager.cloud Traffic Router Ingress
ACME Corp (acme-prod) Tenant Context Resolved
DB: lm_acme_production (Secrets Mgr Pool) Database Connection Pool

AWS Secrets Manager Sync

Rather than compiling database credentials directly into server environments, connection settings are retrieved dynamically. S3 storage and DB parameters remain encrypted in KMS.

Dynamic Decryption: Secret key lookups execute as part of container boots or API warm-up sequences, ensuring credentials never touch local configurations.

Bounded LRU Cache: To minimize AWS Secrets API billing overhead, connection configurations are securely cached with time-to-live boundaries.

AWS Secrets Manager Mock Response
{
"ARN": "arn:aws:secretsmanager:us-east-1:1234:secret:lm/tenant/acme-prod",
"Name": "lead-manager-tenant-acme",
"SecretString": {
"POSTGRES_URL": "postgresql://acme_user:pwd-hash@rds.cluster.internal/lm_acme",
"S3_BUCKET_NAME": "lm-acme-prod-58b29",
"MFA_ENFORCE": true
}
}
System Topography

Isolate Workloads, Not Workflows

Our dual-layer backend segments organizational operations from client operations. Company technicians deploy, patch, and manage subscriptions globally, while clients experience a completely isolated, single-tenant SaaS portal.

No Shared Table Risk

Traditional multi-tenancy relies on SQL filtering (`WHERE tenant_id = x`). One developer bug can leak customer records. Lead Manager eliminates this class of risk at the database layer.

Unified Control Interface

Control connections, track operational analytics, seed configurations, and spin up new tenant S3 file repositories from one company control plane dashboard.

API Gateway Traffic Router

Routes intake request or authenticated panel API requests

Intake & Admin Lambdas

Validates headers, maps contexts, resolves connection URLs

Platform Control DB

Holds domain mappings, billing, user identity memberships

Isolated Tenant DBs

Database-per-tenant Postgres cluster (100% data separation)

Private S3 Buckets

Imports, exports, and call recordings isolated per customer

Operational Lifecycle

Tenancy Management Flow

How Lead Manager coordinates automated creation sequences and operations from a single request entry.

1

Provisioning Command Queue Platform admin

A platform admin creates a tenant. The engine registers domain variables, generates unique identifiers, and initiates AWS provisioning operations asynchronously.

2

Database & Schema Creation Automated Script

The provisioner initiates the client database on the cluster, creates application users with restricted credentials, seeds tables with baseline schemas, and saves connection string configurations in AWS Secrets Manager.

3

SSL Handshake & DNS Resolution AWS Certificate Manager

The engine submits a request to ACM for domain SSL validation. Route 53 points records, generates DNS records, and updates routing mappings on DNS tables.

4

Secure Client Onboarding User access

The system generates a secure, single-use credential link for the workspace admin and fires a welcome instructions email. The client logs in, configures forms, and views isolated dashboards.

Developer API

Integrate Lead Ingestion Instantly

Connect your landing page forms, scrapers, mobile apps, or internal triggers directly to regional lead routers in seconds.

const leadData = {
  name: "John Smith",
  email: "john.smith@example.com",
  phone: "+1555019283",
  source: "google_search",
  notes: "Looking for enterprise tier pricing"
};

const accessToken = "short_lived_access_token";

fetch("https://api.acme-corp.leadmanager.cloud/api/v1/leads", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${accessToken}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify(leadData)
})
.then(response => response.json())
.then(data => console.log("Success:", data))
.catch(err => console.error("Error:", err));
import requests

url = "https://api.acme-corp.leadmanager.cloud/api/v1/leads"
access_token = "short_lived_access_token"
headers = {"Authorization": f"Bearer {access_token}"}
payload = {
    "name": "John Smith",
    "email": "john.smith@example.com",
    "phone": "+1555019283",
    "source": "google_search",
    "notes": "Looking for enterprise tier pricing"
}

response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.json())
curl -X POST https://api.acme-corp.leadmanager.cloud/api/v1/leads \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "John Smith",
    "email": "john.smith@example.com",
    "phone": "+1555019283",
    "source": "google_search",
    "notes": "Looking for enterprise tier pricing"
  }'
Trust & Security

Zero Trust Security Foundations

Engineered with AWS integration rules, Google OAuth validation keys, and physical database separation configurations.

Security Surface Mechanism & Safeguards
Platform Control Plane Google OAuth allowlist authorization check. Zero hardcoded secrets in configurations. IAM role parameters map resource operations dynamically.
Workspace Auth Verification of user identities against platform tables on every session renewal. Passwords hashed using bcrypt, with mandatory MFA options.
Resource Protection Postgres database URLs, access passwords, and S3 credentials saved in AWS Secrets Manager and encrypted using KMS keys.
Deployment Posture GitLab CI pipelines authenticate with cloud endpoints using secure OIDC role configurations, keeping long-lived credentials out of repositories.
F.A.Q.

Frequently Asked Questions

Quick answers to common questions about multi-tenancy logic, security rules, and workspace configurations.

Unlike standard SaaS systems that save all users in a single table filtered by `tenant_id`, Lead Manager boots a physically isolated Postgres database on the cluster for each tenant. The router references connection string parameters dynamically from AWS Secrets Manager using verified auth variables.
When a client configures a vanity domain (e.g. `leads.mycompany.com`), our API invokes ACM to request SSL certificates and generates CNAME validation records. Once DNS checks clear, requests to that hostname are automatically matched to the client's workspace.
Workspaces support standard credentials with secure MFA confirmation flows or Google OIDC logins. Permissions are validated server-side on every request to verify user roles inside the target tenant namespace.
Yes. Because database boundaries map to independent physical databases on the RDS clusters, you can back up and migrate a database to a separate standalone instance without touching the tables of other tenants.

Ready to Launch Your Brand?

Deploy a secure, isolated white-labeled portal. Organize leads, manage domains, and scale operations with absolute database compliance boundaries.

Sign In to Dashboard