Every module your business runs, on one record

Every record knows which customer it belongs to.

Multi-tenant isolation fails in exactly one way: somebody writes a new query and does not add the filter. So the filter is not something a query adds — it is something the model has. Every tenant-owned table carries its tenant, and the models over those tables attach the predicate to every query built through them and stamp it on every row at creation.

A developer adding the hundredth report does not opt in to isolation and cannot forget it. They would have to remove it by name, in a diff, to lose it.

The timeline is assembled at read time, not written to.

There is no timeline table anybody has to remember to write to. Open a contact or a company and the stream is composed on the spot from the six generic tables the work already produced — activities, calls, emails, meetings, notes and attribution touchpoints — newest first. A deal adds three more: its journey enrolments, its documents and its briefings.

That is why a manually logged call, an automated send and a meeting booked from a link all appear in one stream rather than in three tabs that disagree. It is also why adding a capability does not require anybody to go back and teach the timeline about it.

Machine chatter is real history and is not what a rep sees.

Fourteen activity types are what an automation or an integration writes to talk to itself: tag bookkeeping, field pokes, webhook fan-out, sync and import markers, canvas views, the enrol-and-complete churn behind a campaign milestone. They stay queryable and they are hidden by default, behind one toggle. A wall of applied tags is exactly the noise a timeline is supposed to replace.

One permission model, and it reaches the assistant too.

Access is granted per role and, where it matters, per field — a role that should not see a margin does not get the field rather than getting a blurred value. The assistant is held to the same model plus three more gates, and one of those is the identical module predicate the route gate uses, so it can never offer a capability whose screens the workspace has switched off.

Nobody can tell you what actually happened.

The forecast is a set of opinions, the notes are three sentences a week old, and the answer to “what did we say to them” is a person’s memory. Start at Record everything for the capture, then Ask Maddox for the reading of it. That pairing is the platform’s actual thesis: the record is a by-product of the work, so the answers come from what happened rather than from what anyone recalls.

The pipeline is optimistic and the coaching is a feeling.

Every deal is committed and half of them slip. Start at Deals and pipelines for stage requirements and grades, and Coaching for the prep, commitment and evidence cycle underneath the one-on-one. The second is the one people underestimate: it is what turns a manager’s impression into something with a date and a source attached.

Marketing and sales are two systems that argue at month end.

Start at Campaigns for the journey engine and the suppression rules, and the pack catalogue for the parts you would otherwise build from scratch. Both write to the same timeline as everything else, which is the whole point — there is nothing to reconcile because there was never a second record.

You sell IT services, and the audit is a deck somebody rebuilds every time.

Start at IT Audit, and read what an MSP should look for in a CRM beside it. IT Audit is an add-on bought from the Marketplace, with a network and perimeter scanner as a second add-on on top, and it is the pillar most specific to how managed-service providers actually sell — a scored assessment against a company, the customer’s own words captured rather than paraphrased, and a client-facing deck built off the deal rather than off a template somebody edited in a hurry.

No agent acts.

An agent here is a definition you write, scope, test in a sandbox and switch off. Nothing in MADDOX sends an email, creates a record, updates a field or assigns an owner because an agent decided to. When MADDOX does change something it is because a person approved a specific proposal, and what executes is read from the database rather than from the browser that asked. The long version is written up here.

Email is the only channel MADDOX operates for you.

A campaign lane can also carry an HTTP webhook step, which posts contact fields to an address you choose, and an SMS step that sends only where you have connected your own carrier account and taken it out of dry run. Those are things you can build, not things we operate on your behalf, and the webhook in particular works on a default install — which is why it is named here rather than left for somebody to discover.

Throughput is worth stating too: campaign steps are swept in a fixed batch every few minutes across the whole platform, so a large launch delivers over hours rather than at once. A due step can also be suppressed on purpose — unsubscribe, company fit, campaign exclusivity, a fatigue cap — and the reason is recorded rather than silently dropped.

The catalogue is not a directory of other companies’ applications.

What installs from it are campaign packs and templates — content, not code — and two paid MADDOX modules, IT Audit and its Network Scanner add-on. No code anybody else wrote runs in your workspace, and anything in the catalogue was either published by us or approved by us before publication. There is no third-party application ecosystem here and this page is not a soft way of saying one is coming.

Nothing above is a category we intend to enter.

Every pillar on this page is a working part of the product with its own pages behind it, and every one of those pages is written against the code rather than against a roadmap. Where something is partly built, off by default, or a preview of scope rather than a record of an action, the page says which — and when we get that wrong, the correction gets published in the field notes rather than quietly edited in.