India Dubai London

What we build

We turn the tools you run on into one custom CRM system

Most businesses run on four or five tools that don't talk to each other. We bring them together into one secure system, shaped like a CRM around how you actually work. When you add AI, SCRS, the patent-pending firewall from Pop Hasta Labs, keeps it inside your rules and away from your clients' details.

Where it starts

The problems people actually bring us

Nobody wakes up needing an API. They wake up because two systems do not talk to each other, and somebody is paid to sit in the middle retyping things.

integrations

Two systems that don't talk

So the same thing gets typed twice. We connect the systems you already run, with APIs, webhooks and sync jobs that move data both ways.

workflows and portals

A process that lives in someone's head

A custom workflow, portal or internal tool, with personal details stripped before any AI sees them and every action logged.

migration

Years of work stuck in a system you've outgrown

We move your documents, contacts and records off the old system: mapped, duplicates merged, and a record of exactly what moved.

your brand

You want to sell it as your own

Embed the governed chat or the SCRS firewall inside your own product, with your branding, over MCP or a bespoke integration.

desktop apps

It has to run on the desktop

Native Windows applications on the same governed core: files open straight from the machine, work carries on when the connection does not, and an installer your IT can deploy.

a named contact

You need one person who owns it

A scoped engagement with a named contact, clear milestones and support once it is live.

Security and governance

AI security and governance, fixed

Some of the problems we are asked to solve are about keeping data safe, and proving that you do.

The problem

Staff paste client details into ChatGPT

How we solve it

We put SCRS in front of the AI your team already uses, so names and identifiers become tokens before any model sees them, and every AI call is logged.

SCRS
The problem

Nobody is sure who can see what

How we solve it

Roles and permissions down to the field, enforced on the server, with a tamper-evident log of every access, change, refusal and export.

access control
The problem

Nothing to show the regulator or the auditor

How we solve it

Records of processing, impact assessments and consent registers kept by the system, with an audit trail of what happened, so evidence is a report rather than a scramble.

governance registers

How we solve security and governance

Tell us how your business runs.

Start a project

Custom CRMs

Your CRM should fit your business, not the other way round

Off-the-shelf CRMs make you bend to their model. We build CRMs around how your team actually works, and when AI is part of it, SCRS makes sure client data never trains or leaks to a model.

  • Your objects, fields, pipelines and stages, not a vendor's template
  • Workflow automation, routing and reminders wired to your process
  • Moved off spreadsheets or an old system, with every record accounted for
  • AI that drafts, summarises and answers, and never sees a client's name
  • Dashboards and exports your team and your regulator can rely on
An animation from the clinic demo: pressing Sign consent is refused because the reflection period has not finished, and the software says the rule is the clinic's own policy rather than the law.
Try it in the clinic demo (opens in a new tab)

AI in your system

An AI assistant that works inside your rules

Add AI to your system and your team can run it by asking: move the appointment, chase the invoice, update the record. The assistant works through SCRS, so the model sees tokens instead of names, and every action it proposes is checked against your rules and permissions before a named person approves it.

  • Names become tokens before the model sees them
  • A refused step says which rule stopped it, and offers what is allowed
  • Nothing happens until a person approves it
  • Every step is logged where nobody can quietly edit it
An animation: someone asks the AI assistant to move a patient's appointment and send her aftercare notes. SCRS swaps her name for a token before the model sees it. The assistant proposes three steps: the WhatsApp message is refused because there is no consent, an email is offered instead, and nothing happens until a named person approves. Every step is logged.

Tell us how your business runs.

Start a project

What we can build

Pick only what you need

Six core modules are the foundation of every build, and everything else is chosen from this list: 101 items across 13 sections. It is the same list we scope from, so this page and your scope say the same thing.

Already yours

Included

The six core modules, the secured automation engine that runs everything else, and the application security on our security page. They come with every build.

  • Overview dashboardWaiting, owed, due and needing a decision, counted live from the records, per role
  • Pipeline and stagesNamed stages in your words, a drag-and-drop board and list, stage rules and ownership
  • Records: people and companiesPeople, companies, the links between them, custom fields, merge and dedupe
  • Diary and schedulingAppointments against people, rooms, bays, vehicles or staff, with conflicts and working hours
  • Catalogue and price listWhat is sold, how long it takes, price, tax, variants and pricing per market
  • Billing and invoicesQuote to invoice to paid, deposits, credit notes, numbering and PDFs
  • Secured automation engineThe governed rule runner: triggers, conditions, multi-step actions and scheduling
  • Draft-and-release controlNothing sends by itself: the engine writes the message and a named person releases it
  • Injection and XSS hardeningParameterised queries throughout, a strict Content Security Policy, output escaped by default
  • Sign-in hardening and rate limitsRate limits that fail closed, captcha and honeypots on public forms
  • Transport and headersHTTPS enforced, HSTS, and frame embedding denied
  • Data residencyThe hosting region chosen at scoping and set up on deployment
  • Edge and DDoS protectionConfigured on deployment as part of the infrastructure

Operating layer

Chosen

The screens your day actually happens on: the work, the calendar, the files, and a search that goes across all of them.

  • Message templatesTemplates for each channel, with merge fields, preview and versions
  • Web-to-lead formsA public form that creates the record, with spam protection, routing and a response clock
  • Branding and settingsYour colours, logo, wording, module names and defaults
  • Security and audit logA tamper-evident record of every access, change, refusal, override and export
  • Search across recordsOne search over everything, filtered by what each person may see
  • Another language (each)Written strings, plural rules, date and number formats, right to left where needed
  • Another currency (each)Prices set locally, symbol and format, a catalogue per market
  • Reporting and chartsSaved reports, filters and grouping, with charts that open back to the record
  • DashboardsDashboards you can arrange, built from the saved reports
  • Scheduled reportsReports emailed on a schedule to named people
  • Drag-and-drop boardsBoard views on any pipeline, with rules on the drop
  • Mobile and responsiveEvery screen usable on a phone, not a shrunken desktop

Team management

Chosen

Who is on, who did what, and who is allowed to, down to the field.

  • Roles and permissionsNamed roles and what each may see, do and change, enforced on the server
  • Access per fieldField-level visibility and edit rights, so a salary or a medical note stays private
  • Invitations, seats and profilesInviting people, seats, profiles, password and session policy
  • Delegated admin rightsThe owner gives specific admin powers to specific people
  • OffboardingOne action removes a leaver from everything, and the record of what they could see survives them
  • Skills and certification matrixWho is qualified to do what, and whether it is still current

Rules engine

Chosen

The part that says no. Your policy written once, kept everywhere, with a record of every time it fired.

  • A check must existA named document, consent or certificate present and in date before a step
  • A period must passReflection, cooling-off or rebate periods counted by the software
  • Something must be in dateA consumable, licence or registration valid at the moment it is needed
  • Refusals that explainThe block, the rule behind it, whether it is law, regulator or house policy, and the lawful override
  • A new kind of ruleA rule that is none of the three above, written for you

Communication

Chosen

Email, messages and documents that stay attached to the record they belong to, so nothing lives in one inbox.

  • Internal notesNotes on any record, mentions and visibility rules
  • Email outSend from the record, with templates and delivery logging
  • Two-way inboxA mailbox with threading, and replies filed against the record
  • WhatsApp BusinessMeta integration, template approval and consent per channel
  • SMSGateway integration, delivery receipts and opt-outs
  • Live chat widgetA website widget with routing and handover to a person
  • Ticketing and shared inboxA shared queue with ownership, targets and a knowledge base
  • CallsClick to call, and calls logged against the record
  • Consent per channelConsent recorded and kept separately for each channel

AI

Chosen

Drafting, reading and summarising inside the same permissions as everything else. It never sees what the person using it is not allowed to see.

  • AI drafting on every messageAny outbound message drafted from the record, for a person to release
  • SCRS connectionThe build wired into SCRS, so every AI call is governed
  • In-app assistantAsk questions of your own records, filtered by permission
  • Document questions and summariesAnswers from your own uploaded documents
  • Auto-resolve (opt-in)Governed sending and closing, switched off unless you turn it on
  • Automations in plain wordsDescribe the rule and get a governed workflow
  • Spend caps and usageSCRS meters every call, shown inside your system

Money

Chosen

Quote to cash, in your currency and your tax rules, reconciled against the bank.

  • DepositsTaken, tracked and credited against the final bill
  • Tax per line and per marketRates by line and by market, inclusive or exclusive
  • Quote to invoiceOne record from the first price to the final bill
  • Payment linksThe customer pays from the bill, reconciled back to the record
  • Refunds and creditsAgainst the original trail, never an orphan record
  • Overdue chasingScheduled chases in your wording, logged beside the invoice
  • Revenue reportingBooked, invoiced, collected and outstanding, each one openable
  • Purchase orders and supplier invoicesWhat was ordered, what arrived and what it cost

Customer-facing

Chosen

The parts your customers touch: booking, portals, forms, and the signature at the end.

  • Online bookingYour diary, your rules and your availability, written straight into the record
  • Customer portalCustomers see their records, documents and history
  • Reviews and feedbackRequested, collected and attached to the record
  • CampaignsSends to people who agreed to hear from you
  • Your public websiteThe site itself, designed and built

Scanning and stock

Chosen

Barcodes, serials, batches, and what is on the shelf right now.

  • Barcode and QR scanningScan with a phone or a handheld to open a record, confirm a part or finish a step
  • Asset registerTools, keys and machines: who has it, where it is and when it is due back
  • Stock takesScan-based counts against expected quantities, with a variance somebody signs off
  • Goods in and outReceive against a purchase order, dispatch against a job
  • Batch and serial tracingWhich batch went into which job, and which jobs a recalled batch touched
  • Label printingLabels for parts, shelves, samples and assets, printed from the record
  • Maintenance and calibrationService and calibration due by date, hours or cycles

Resources and floor

Chosen

Rooms, bays, kit and people, booked against real availability.

  • Drawn floor planA plan of your actual space
  • Resource timelineRooms, bays, vehicles or staff across days, on a tape chart
  • Capacity and conflict rulesNo double-booked bay, no party of six at a table for four

Field and mobile

Chosen

The same system on a phone, including where there is no signal.

  • Offline modeScanning and job updates keep working in a basement or a van with no signal
  • Photo and video evidenceCaptured against the job, with a timestamp
  • TimesheetsScan a job to start and stop the clock, and the hours land against it

Data and integrations

Chosen

Getting your history in, getting your data out, and talking to whatever you already run.

  • Migration from your old systemExtracted, mapped, cleaned, loaded and reconciled against the old system
  • ExportEverything back, any time, in a usable format
  • API and webhooksA documented API and outbound webhooks with retries
  • Calendar syncGoogle and Outlook, both directions, with conflict handling
  • Document storagePrivate storage, filed per record, with retention
  • Document capturePhotograph a certificate or an invoice and the system reads it
  • Accounting syncXero, QuickBooks or Sage kept in step both ways
  • Any other system (each)Whatever else you still run

Automations

Chosen

Each one checks the permission and the rule before it fires, and nothing sends by itself: the software writes it and a named person releases it.

  • Appointment reminderCatches the no-show you would otherwise absorb
  • Deposit requestThe booking held without commitment
  • Document chaseThe certificate missing on the day
  • Expiry warningThe licence, registration or stock that lapsed quietly
  • Response clockThe enquiry nobody picked up, owned by name
  • Cooling-off or rebate endingThe period the software counts instead of a person
  • Renewal noticeThe subscription that renews without warning
  • Training or supervision dueThe check that expires while somebody is still rostered
  • Follow-up sequenceThe quote that went quiet
  • Review requestThe happy customer who never said so publicly
  • Overdue chasingThe invoice nobody wanted to ring about
  • Recall and rebookingThe customer due back who forgot
  • Dormant customersThe customer who quietly stopped coming
  • Handover and sign-offThe job finished but not signed
  • Inbound triageWhat arrives, routed and put in order

By trade

Rules already worked out for your trade

Each one exists because of a rule that trade actually has to follow. If yours is not here, it gets written down on the scoping call.

  • Aesthetics clinic

    Consent and reflection period · Clinical photography · Stock and batches · Prescriber sign-off · Recall

  • Accountancy and law

    Conflict register · Client due diligence and KYC · Client account handling

  • Recruitment

    Right to work checks · References · Rebate period

  • Garage and bodyshop

    Authority to proceed · Parts and suppliers · MOT and service due

  • Estate agency

    Compliance pack per listing · Key management · Rent and arrears

  • Hospitality and rooms

    Allergy notes · Tips and service charge

  • Trades and home services

    Certificates · Engineer registrations · Job sheets · Warranties

  • Construction and fit-out

    Site file · Method statements · Permits to work · Clearance certificates

  • Childcare and nurseries

    Background checks · Staff to child ratios · Allergies and medical · Incident log

  • Veterinary

    Consent · Controlled drugs register · Vaccination recall · Insurance claims

  • Dental

    Consent · Radiograph justification · Recall · Lab work

  • Home care

    Care plans · Medication records · Visit verification · Training matrix

  • Fitness and studios

    Health screening · Membership and cooling-off · Class capacity · Packages

  • Beauty, tattoo and piercing

    Patch test timing · Consent · Licences · Aftercare

  • Driving schools

    Licence checks · Lesson packages · Test bookings · Vehicles

  • Financial advice

    Fact-find · Suitability report · Cooling-off · Vulnerable customer flags

  • Events and weddings

    Run sheet · Suppliers · Deposit schedule

  • Removals and storage

    Inventory · Insurance in force · Proof of delivery

Tell us how your business runs.

Start a project

Automation

A CRM records what happened. Automation stops you doing it by hand.

And the AI inside it never sees a client's name.

before

Someone remembers

A reminder that depends on a person having a good week, a follow-up that happens if the diary is quiet, a recall nobody runs.

after

The system drafts, a person sends

Every message is drafted and waits for a person to release it. A message to someone who never agreed to that channel is refused, with the reason on screen.

underneath

The model works blind

Names, dates of birth and treatments are stripped before the model is called, and the audit line records exactly what was removed.

SCRS in your stack

Or put SCRS inside the systems you already run

You don't have to move onto a new system to get governed AI. We build SCRS, the patent-pending firewall, into your CRM, case or practice system, data warehouse or your own application, so every prompt is redacted before it reaches a model. It works with Dynamics, HubSpot, SAP, AWS and more.

  • Redaction before the model

    On the apps you already use, with nothing ripped out and replaced.

  • Connected your way

    Over an API, MCP or a bespoke connector we build for you.

  • Vault and audit

    An encrypted vault and a tamper-evident audit trail across every AI call.

  • Data residency

    Agreed at scoping and written into the contract.

  • Looked after for you

    We run, monitor and maintain the governance layer, and your team keeps working.

Tell us how your business runs.

Start a project
30k+ people a month use SCRS-governed software the Pop Hasta family has built and runs
10 industry demos you can click through today
5 languages in every demo, Arabic included
4 currencies, each priced by hand, never converted

Timing

How long it takes to build a custom CRM

from scope to live

Six to twelve weeks

Most builds run six to twelve weeks from agreed scope to live: nearer six for a tightly scoped build, nearer twelve for a larger one with a migration or a front end of its own. How quickly answers come back changes the date too.

after it ships

Looked after once it's live

An annual maintenance contract covers minor updates, small changes, fixes, security patching and support. Larger new work is scoped on its own.

A good fit

Who we build custom software for

  • Regulated firms with a system that must integrate

  • Teams that need a bespoke governed workflow or portal

  • Products that want to embed SCRS or governed AI

  • Teams keeping their current systems but adding SCRS

  • Businesses moving off spreadsheets or an old system

Tell us how your business runs.

Start a project

Not a fit

When to call someone else

Saying who we turn away is worth more than a testimonial, and it saves us both a call.

  • A cheap rebuild of something that already works

  • A one-week job

    Scoping alone takes longer than that.

  • Anything where the AI must see raw client data to work

    We will not build it.

  • A project with no owner on your side

    Bespoke software needs somebody on your side who decides.

Tell us how your business runs

We'll show you what it could look like, measured to fit before anything is built.