Skip to content
Home Permissions

Your customer list is the asset. Furnishi is built to protect it.

The partner firm installing your kitchen also installs for your competitors. Every time you send them a name, a number and an address on WhatsApp, you hand over a piece of your database. Furnishi makes that structurally impossible.

The matrix

Who sees which field.

A simplified view of the live matrix. "part" means the partner sees the pincode and locality needed to reach the site, but not the door number or the customer name.

RoleOrder IDCustomer nameMobile numberAddressPincodeLocation codeProduct & codeFace areaStart / end dateStatusQuote valueSnag cost
Factory Manager (FM)
Customer Coordinator (CC)
Factory Coordinator (FC)
Source Coordinator (SC)
Work Partner (WP)part
Survey Partner (SP)part
Counted on the real screensOn the full order record a Factory Manager sees 37 fields, a Factory Coordinator 20, a Customer Coordinator 19, a Work Partner 7, a Source Coordinator 6 and a Survey Partner 5. The matrix is configurable per factory — these are the defaults.
Proof, not a promise

The same screen, two accounts.

No filter was applied and no setting was changed between these two screenshots. Only the account changed.

factory/enquiry
<b>Factory Manager.</b> Name, mobile, address, coordinator, area, value — 37 fields available.
Factory Manager. Name, mobile, address, coordinator, area, value — 37 fields available.
factory/enquiry
<b>Work Partner.</b> The identity columns do not render, are not in the export, and were never sent to the browser.
Work Partner. The identity columns do not render, are not in the export, and were never sent to the browser.
How it is enforced

Hiding a column is not security.

Plenty of systems will grey out a field in the interface while the data still travels to the browser, sits in the network response and lands in the CSV export. Furnishi enforces the restriction three layers down.

  • Database — partner-facing screens read from views that do not contain the identity columns at all.
  • Row level — RLS policies bind every query to one tenant; a partner query cannot cross factories.
  • API — the response is built from the role’s allowed field list, so the payload is short.
  • Export — CSV is generated from the same list. There is no wider file to download.
  • Audit — every read of a restricted field by a privileged user is recorded.
factory/orders/ORD02601
The full order record as the factory sees it. A partner opening the same order gets a different document, not a redacted one.
The full order record as the factory sees it. A partner opening the same order gets a different document, not a redacted one.
Why it matters commercially

The partner is a supplier, not a co-owner of your customers.

Factories lose repeat business and AMC revenue when a partner firm builds its own relationship with the homeowner. Column-level permissions are the cheapest insurance you can buy against that — and the customer app means the homeowner's relationship stays with your brand, not with whoever turned up with a drill.

Bring your own permission questions to the demo.

Tell us the field you are worried about. We will show you exactly who can see it and where that is enforced.