Making a founder-built Lovable app client-ready

The problem

Acquisition House's founder built his own client portal in Lovable: a property roadmap that plots each client's purchases, granny flats and refinances year by year, backed by a genuine financial engine. It looked finished.

Underneath, login had been switched off, so anyone with the address could read and change client records. A client could pull the adviser's private notes straight from the database. Invite emails were reported as sent but silently dropped by Gmail, and the links inside them pointed at an unfamiliar domain that mail scanners treat as phishing. None of it threw an error. Another adviser's verdict was to abandon Lovable altogether.

What we built

• No rewrite and no new features: a harness around the app he already had
• Invite-only sign-in with separate adviser and client entry points, a password or an emailed code, and a Cloudflare bot check on the login form
• Database rules locked down so each client only ever sees their own roadmap, with new clients synced in from Twenty CRM
• Email fixed at the root: the sending domain passes the strict DMARC policy that had been bouncing every invite, and links point back to the portal's own domain
• All six auth emails branded and restyled to the portal's design system, so they hold up in Outlook and dark mode
• Their own favicon, a branded preview card when a portal link is shared, a proper title on every page, and Google Analytics on the live site
• Permission helpers and a test that fails any server function that forgets to check who is asking
• End-to-end tests that drive the real invite and sign-in flows, and CI that opens an issue the moment Lovable pushes a broken change
• Nightly encrypted backups and patched dependency advisories
• Project rules every AI tool reads first, and recipes for the changes he makes most often

Screenshots

The result

• No rewrite: the founder's own build is the product
• Each client sees only their own data, behind invite-only sign-in
• Branded emails that land in the inbox, from the portal's own domain
• 500+ tests and CI that flag a broken change before a client does
• Client-ready on its own domain, and he keeps shipping himself