The internal tool that started as a spreadsheet replacement and is now load-bearing
Internal tools are where AI builders are most obviously useful and most quietly dangerous. Useful because the requirements are known and the users are down the hall.
- More than three people use it every day and one of them is not technical.
- Somebody outside the team has asked who can see the data in it.
- It has an export button that half the company relies on.
- The person who built it is the only person who can change it.
- It has never been backed up, or it has and nobody has tried a restore.
Where a generated prototype stops being enough
Not general advice. These are the failures specific to this kind of product, and none of them are visible on screen.
- 01
Access control was written for a team of three
The first version has one role: staff. Then somebody hires a contractor, or an intern, or a regional manager who should see one branch and not the others.
- 02
There is no audit trail, and one day there needs to be
Who changed this price? Who approved this refund? Who deleted this customer?
- 03
It became a system of record without a decision
Data that exists nowhere else accumulates in the tool. At that point backups, retention and export stop being nice-to-haves, and the fact that the whole thing lives on a builder's hosted plan with no tested restore becomes a real business risk rather than a technical one.
- 04
Everyone logs in with a password nobody rotates
Internal tools rarely get single sign-on because the first version did not need it.
The sentences we hear most, and what we do about each one
"It works, but I cannot let the new hire near it"
Onboarding a person to a tool that has one permission level means either granting them everything or excluding them.
How we helpWe model the roles the business actually has, enforce them at the data layer rather than in the interface, and cover them with tests that assert one role cannot reach another's records.
"Finance asked me who changed a number and I could not tell them"
The tool stores current values. The previous value, who set it and when, is gone.
How we helpAn append-only audit log on the tables that matter - money, permissions, customer records - with actor, timestamp, before and after, plus a readable history view in the app.
"Our only admin left the company"
The builder account, the deploy credentials and the domain were all in one person's name.
How we helpOwnership transfer is part of every engagement: accounts in the company's name, credentials in a shared vault, code in an organisation repository, and a written list of what exists and who controls it.
"It gets slower every month and I do not know why"
Internal tools accumulate rows faster than customer-facing apps because they log everything and delete nothing.
How we helpWe profile against the real data volume, add the indexes the query plans ask for, paginate the unbounded views, and archive what does not need to be in the hot table.
The parts that make it hold
Roles that match the org chart
Record-level permissions enforced in the data layer, tested across roles, and expressible without a code change when the business reorganises.
Audit trail and history
Append-only logging on the tables that carry money, permissions and customer data, with a history view a non-engineer can read.
Single sign-on
Google Workspace, Microsoft Entra or Okta, so joining and leaving the company is what grants and removes access.
Bulk operations that do not time out
Imports, exports and batch edits moved to background jobs with progress and failure reporting, instead of a request that dies at thirty seconds.
Backups you have restored
Point-in-time recovery enabled, and a restore actually performed during handover so the recovery time is a number you know.
Ownership in the company's name
Accounts, domains, repositories and credentials transferred and documented, so no single person is a dependency.
Usually connected to
- Google Workspace / Microsoft Entra / Okta for sign-on
- Accounting: Xero, QuickBooks, NetSuite
- CRM: HubSpot, Salesforce, Pipedrive
- Slack or Teams for approvals and alerts
- Stripe for billing data
- Data warehouse export for reporting
In the order it actually happens
Growth does not break everything at once. For this kind of product it breaks these four things, in this sequence, and each one is cheap to fix before it happens.
| At | What breaks | becomes | The fix |
|---|---|---|---|
| 5–10 daily users | One permission level stops matching the org chart | Role model and record-level authorization, enforced at the data layer | |
| First audit or dispute | Nobody can say who changed what | Append-only audit log plus a readable history view | |
| ~100k rows | List views and exports start timing out | Indexes from real query plans, pagination, background exports | |
| First leaver | Access persists because there is no directory | Single sign-on, so offboarding is one action in one place |
Four phases, each ending in something you keep
The first one is free. Scope is fixed after it, and you keep the findings whatever you decide next.
- 013–5 days
Production Check
Free. We read the tool with the questions an auditor would ask: who can see what, what is logged, what happens if it disappears.
You receive
- Access-control review, role by role
- Data inventory: what exists only here
- Backup and restore assessment
- Ranked plan with effort estimates
- 021–3 weeks
Permissions and audit
The role model is built and enforced in the data layer, and audit logging goes onto the tables that matter.
You receive
- Role model with record-level enforcement
- Cross-role test suite running in CI
- Audit log and readable history view
- Single sign-on wired to your directory
- 031–2 weeks
Durability and speed
Backups verified by an actual restore, slow views profiled and fixed, bulk operations moved off the request path.
You receive
- Point-in-time recovery with a measured restore time
- Indexes and pagination on the paths that were slow
- Background jobs for imports and exports
- 043–5 days, plus 30 days support
Ownership and hand over
Accounts and credentials moved into the company's name, documentation written, and a walkthrough so somebody other than the original builder can maintain it.
You receive
- Ownership transfer with a written inventory
- Runbook and architecture documentation
- Monitoring and alerting live
- 30 days of post-launch support
Before you book the call
The two questions that decide it are whether it holds customer data and whether a contractor has an account.
Usually yes. Internal tools are the best case for keeping the builder as the fast path, because the users are forgiving and the release risk is low.
Sometimes, and we will say so. If your tool is mostly CRUD over a database, a commercial platform is cheaper to own than a custom app.
The Production Check is free. Hardening an internal tool is typically two to five weeks of fixed-scope work, quoted from the findings, starting at $2,000.
Related solutions
Field service management
Dispatch, job tracking and a technician app that has to work in a basement.
See what breaksOperations dashboards
The numbers the business runs on - accurate, fast, and the same for everyone.
See what breaksCustomer portals
Where your customers log in to see their own data - and only their own.
See what breaks
Building business internal tools?
The first review is free, and it ends with a straight answer - including when the answer is to buy something off the shelf instead.