SBLOCAL CREATIVE Interactive Design · Replay Intro
SBLocal Creative · Team United prototype documentation

Team United Web Lead System
User & Installation Guide

A practical prototype guide for installing, configuring, securing, and operating Team United—from the first server upload to daily inquiry management and team coordination.

Self-hostedUp to 10 team membersResponsive interfaceRole-based accessPrototype · Active Development
Prototype / Development NoticeTeam United Web Lead System is currently a working prototype under active development. Features, interface elements, security controls, installation requirements, licensing, pricing, configuration options, and workflow concepts described in this guide may change as the system is tested and refined. This documentation describes the current development direction and is not a final product specification.
Read before installationTeam United handles business inquiries, correspondence, assignments, notes, and employee activity records. Install it only on a domain and hosting account you control. Make a complete website and database backup before replacing or updating files.
Demonstration versus productionPublic demonstrations use fictional data and may include simulated access, sample users, or features that are still being evaluated. Demonstration credentials are not production authentication. Planned or experimental features should not be used with real business or customer information until they are included in a tested production release.

Team United product model

Team United is being developed as a small-business web lead and inquiry coordination system. The core product is intended to give a team one shared place to see incoming inquiries, determine who is responsible, record what has been done, and identify what happens next.

Designed for the working teamThe introductory Team United model is planned to include up to 10 team members. A restaurant, print company, automotive shop, contractor, local service company, or other small business can assign titles and permissions that reflect the way its staff actually works.

Core system, enhanced configuration & custom workflow

1

Core Team United

Standard inquiry capture, assignments, replies, notes, statuses, follow-up, team visibility, administrator controls, and up to 10 team members.

2

Enhanced configuration

Business-specific inquiry categories, terminology, user roles, status options, form adjustments, routing preferences, and other configuration within the supported system.

3

Custom workflow development

Specialized fields, conditional logic, custom routing, integrations, or business-specific workflows that require development beyond the standard installation are scoped and quoted separately.

One core system; different business configurationsTeam United is not intended to become a separate codebase for every industry. The core application remains consistent while supported categories, terminology, roles, and selected workflow settings can be configured for the organization.
Customization is not unlimited programmingEvery business handles inquiries differently. Additional fields and workflow requirements are evaluated during configuration. Development outside the standard Team United installation may require an additional quoted fee after the requirements are scoped.
Back to top

1. Server requirements

Confirm compatibility before uploading Team United. Your exact release may specify a newer minimum version or additional requirements.

▣

Web server

Apache or a compatible HTTPS web server with URL rewriting, sessions, and protected directories.

</>

PHP

A currently supported PHP 8.x release with PDO, JSON, mbstring, OpenSSL, and session support.

▤

Database

MySQL 8.x or compatible MariaDB, plus one dedicated database user with only the required privileges.

  • A valid SSL certificate and forced HTTPS
  • Access to the hosting file manager, SFTP, or a deployment tool
  • Access to database creation and scheduled backups
  • A working mail service or authenticated SMTP provider
  • A private administrative email address for the primary owner
Do not install on obsolete PHPUnsupported server software may contain known vulnerabilities. “It loads” is not the same as “it is safe.” Confirm your hosting version before entering real business data.
Back to top

2. Installation: beginning to end

These steps describe a conventional self-hosted Team United installation. Keep the supplied filenames and directory relationships intact unless the release notes explicitly document another structure.

Recommended file structure

public_html/ ├── index.html Existing public website ├── assets/ Existing public assets ├── api/ │ └── contact/ Public form receiver │ ├── contact.php │ └── contact-config.php └── team-united/ Private application directory ├── index.php Application entry point ├── assets/ │ ├── css/ │ ├── js/ │ └── images/ ├── api/ Authenticated application actions ├── config/ Private configuration ├── storage/ Protected exports and logs └── documentation/ This guide (optional)
Keep the contact receiver separateThe public contact endpoint accepts website inquiries. The application API performs authenticated dashboard actions. Do not merge these responsibilities into one file.

  1. Back up the existing website

    Download the current website files and export its database. Record the PHP version and active DNS/mail settings.

  2. Create the application database

    In the hosting control panel, create a dedicated database and database user. Generate a unique password and grant that user access only to this database.

    Import the supplied schema file using the hosting database tool. Do not reuse a WordPress administrator password.

  3. Upload the application package

    Extract the release ZIP locally. Upload the complete application folder to /public_html/team-united/ using SFTP or the hosting file manager.

  4. Protect private directories

    Prevent direct web access to configuration, storage, backups, and logs. Apply the server rules supplied with the release and confirm that opening a protected file URL returns 403 Forbidden.

  5. Enter the server configuration

    Set the database host, database name, username, password, application URL, organization name, timezone, mail transport, sender address, and reply address in the supplied configuration file or setup screen.

  6. Set production mode

    Disable visible PHP errors, enable secure session cookies, set the application environment to production, and confirm HTTPS is forced before login credentials are created.

  7. Connect the website form

    Point the public contact form to its installed receiver, normally /api/contact/contact.php. Match every HTML field name and allowed option to the server configuration.

    Use a honeypot, same-origin validation, rate limiting, and server-side validation. Never rely on browser validation alone.

  8. Test delivery without real customer data

    Submit a clearly labeled test lead. Confirm it appears once in the dashboard, reaches the intended notification mailbox, and sends a visitor confirmation only when that option is enabled.

  9. Create the primary owner

    Open the private application URL and complete first-run setup. The first authorized account becomes the Primary Owner. Use a unique password and record the recovery method securely.

  10. Add the initial team

    Invite users into available seats, assign job titles, and grant only the permissions each person needs. Confirm each invitation individually.

  11. Complete the launch checklist

    Test login, logout, password recovery, lead reply, internal message, transfer approval, export, archive, mobile layout, and backup restoration before announcing the system to employees.

Installation is complete only after restoration is testedA backup that has never been restored is an assumption, not a recovery plan.
Back to top

3. Users, roles & permissions

Titles describe people; permissions control actions. “Chef,” “Head Server,” “Estimator,” “Production Manager,” “Service Advisor,” or other business-specific titles can be customized without granting unrestricted authority.

Primary Owner

  • Controls organization settings and branding
  • Manages users and temporary authority
  • Approves sensitive account actions
  • Views reports and historical records

Lead Coordinator

  • Reviews and assigns incoming leads
  • Replies, follows up, and archives when permitted
  • Publishes announcements when authorized
  • Cannot take ownership from the Primary Owner

Team Member

  • Views leads assigned to the account
  • Replies and schedules follow-up
  • Sends private internal messages
  • Requests transfers rather than taking leads

Custom or Limited Role

  • Receives only explicitly granted capabilities
  • May be used for assistants, field staff, or observers
  • Should begin with the minimum necessary access
  • Can be revised after promotion or reassignment
Business-specific titles are configuration, not new softwareA restaurant may use titles such as Chef, Bar Manager, Head Server, Assistant Manager, or Catering Coordinator. An automotive shop may use Service Advisor, Parts Manager, Technician, or Office Manager. The permission model remains consistent even when the titles change.
Owner authority is not a job titleDo not make every manager an owner. Keep one accountable Primary Owner and use time-limited delegation when that person is unavailable.
Private management queueIncoming and unassigned leads are visible only to authorized management. Team members see only leads formally assigned to their accounts, cannot browse the incoming queue, and cannot claim leads for themselves. Management reviews and deliberately assigns each inquiry.
Back to top

4. Reading the dashboard

The dashboard concentrates the work that needs attention. What appears depends on the logged-in user’s permissions.

Attention counts

Overdue, due today, upcoming, unassigned, and transfer counts identify immediate work. Unassigned counts are restricted to authorized management.

Presence

Online, away, offline, or—when authorized—invisible indicates availability, not physical location.

Current view

My Leads and My Messages restrict information to the current user. On mobile, team members receive a focused view of assigned leads, related follow-ups, messages, and permitted transfer actions. Broader views require explicit permission.

Back to top

5. Managing leads

A lead or business inquiry should move through a deliberate lifecycle. Avoid leaving an inquiry unassigned or using archive as a substitute for answering it.

StatusMeaningRecommended action
NewReceived but not fully reviewed.Screen, verify, and assign.
AssignedA team member is responsible for the next action.Contact the visitor promptly.
Awaiting ReplyYour business responded and is waiting.Schedule a reasonable follow-up.
Follow-UpA future action is scheduled.Complete, reschedule, or cancel with a note.
AnsweredThe inquiry received a substantive response.Continue the thread or close when resolved.
ClosedNo further action is expected.Retain the record; reopen if necessary.
ArchivedRemoved from active work without deletion.Use for preserved inactive records.

Daily lead workflow

  1. Open the lead and verify the contact information.
  2. Review screening indicators and previous activity.
  3. Assign the lead to the appropriate authorized user.
  4. Reply from the lead thread so the response remains recorded.
  5. Set a status and schedule the next action.
  6. Close or archive only when the outcome is understood.
Inquiry categories can reflect the businessA restaurant might use Catering, Private Party, Large Group, Vendor, Employment, and General Inquiry. An automotive business might use Repair Estimate, Appointment, Parts, Fleet Service, Warranty, and General Inquiry. A print or creative company might use Website, Printing, Graphic Design, Custom Artwork, Video, Reorder, and General Inquiry. Supported categories can be configured without changing the core workflow.
Email copies and dashboard records are differentDeleting a notification in Gmail does not remove the dashboard record. Marking a dashboard inquiry as spam should not block your own website sender address in an external mailbox.
Back to top

6. Internal messages

Messages let authorized users coordinate without exposing private notes to the website visitor.

1

Choose a recipient

Open Team, confirm the person and presence indicator, then select Send Message.

2

Write a useful subject

Reference the lead, project, decision, or deadline. Avoid vague messages such as “Call me.”

3

Keep customer replies separate

Internal messages are for employees. Use the lead thread to communicate with the visitor.

4

Preserve context

Reply in the existing thread when continuing the same subject.

Back to top

7. Assignment & transfer requests

Users may request a reassignment, but transfers remain subject to approval by authorized management.

  1. Request

    The current assignee selects the proposed recipient and provides a business reason.

  2. Review

    The authorized decision-maker reviews workload, experience, history, and fairness.

  3. Approve or deny

    The system records the decision, decision-maker, time, and reason.

  4. Notify

    Affected users receive the outcome. The lead remains with the original assignee until approval succeeds.

Back to top

8. Company announcements

Announcements distribute organization-wide information and can request acknowledgement.

  • Use a clear title, publication time, expiration date, and priority
  • Request acknowledgement only when confirmation is genuinely needed
  • Review recipient and acknowledgement counts from the sender’s view
  • Use approved decorative images sparingly and provide accessible alternative text
  • Allow expired announcements to leave the active dashboard while preserving the record
Announcements are not emergency systemsDo not rely on a dashboard announcement for urgent life-safety instructions unless the installation has been formally integrated with an approved emergency notification process.
Back to top

9. User accounts

Introductory team sizeThe current product direction is to include up to 10 team members in the standard small-business installation. Final licensing and pricing remain subject to change during prototype development.

Add a user

  1. Open Team and select an available seat.
  2. Enter the person’s real name, company email, title, and access profile.
  3. Review permissions; remove anything unnecessary.
  4. Send the invitation. The seat remains pending until accepted.
  5. Confirm the user can log in and sees only the intended information.

Edit, suspend, or deactivate

Title and permissions may change as responsibilities change. Suspension temporarily blocks access. Deactivation ends current access without destroying historical records; reactivation requires a deliberate authorized action.

Never delete employment history to free a seatBefore deactivation, reassign open leads, record the effective date and reason, preserve account activity, and create an export when company policy requires it.

Temporary delegation

The Primary Owner may grant selected capabilities to an authorized user for a fixed period. Delegation should expire automatically and must not transfer ownership, billing control, or historical ownership records.

Back to top

10. Appearance & branding

Owner-only controls can coordinate the application with the business website without exposing arbitrary CSS or font changes.

Header mode

Show the branded header for a standalone installation, or hide the public header when the system is embedded beneath an existing website header.

Application title

Use Team United Web Lead System or an approved business-facing title supported by the installed configuration.

Colors & buttons

Select accessible header, navigation, button, and status colors while preserving readable contrast.

Preview, then commitPreview branding changes in the owner’s browser, inspect desktop and mobile layouts, then explicitly commit. Discard should leave the published interface unchanged.
Back to top

11. Records, reports & exports

The system preserves operational history; it does not prove a person’s physical location or identity at a specific moment.

Lead reports

Received, assigned, answered, awaiting reply, closed, archived, and follow-up activity by date range.

User account history

Invitations, permission changes, suspensions, deactivations, assignments, messages, and decisions.

Former users

Search preserved accounts without reactivating them. Open leads should already have been reassigned.

Local exports

Download periodic CSV, text, or supported report formats and store encrypted copies according to company policy.

Accurate language mattersA record can show that credentials interacted with the system. It cannot establish who used those credentials, where that person was, or whether work occurred away from the application.
Planned: prospecting and attributionA future production module may preserve timestamped prospecting contacts, personalized referral links and QR codes, customer-selected referral sources, possible prior-contact matches, shared contribution records, and versioned corrections. Attribution would recognize who helped create an opportunity; assignment would identify who is currently responsible for handling it. These capabilities are roadmap concepts and are not part of the current prototype unless explicitly identified in the release notes.
Back to top

12. Security checklist

Team United uses a shared-responsibility model in a self-hosted deployment. Application security must be built into Team United, while hosting-account, server, SSL, backup, DNS, mail, and infrastructure security also depend on the client and hosting provider.

No compliance certification is impliedThe prototype does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, or other third-party certification or regulatory status. Security controls and any future compliance requirements must be evaluated against the customer’s actual use case and market requirements.
  • Force HTTPS and secure session cookies
  • Use unique passwords; multi-factor authentication may be added or enabled when supported by the installed release
  • Hash passwords with PHP’s current password API; never store plain text
  • Use prepared database statements and server-side authorization on every action
  • Require CSRF tokens for state-changing requests
  • Validate, limit, and encode all visitor input
  • Disable file uploads unless a separately secured feature explicitly requires them
  • Keep configuration, logs, exports, and backups outside public reach
  • Rate-limit login and form submissions
  • Review active accounts and delegated authority regularly
  • Apply supported PHP, database, application, and server updates
  • Maintain off-server encrypted backups and test restoration
Data scopeTeam United is intended for ordinary business inquiries, contact information, correspondence, assignments, and workflow records. It is not designed by default to collect payment-card numbers, Social Security numbers, medical records, or other highly regulated data. Customers are responsible for determining whether their use requires additional controls or legal review.
No internet-connected product is guaranteed unhackableThe responsible promise is layered protection, prompt maintenance, minimal retained data, reliable backups, and a documented response plan.
Back to top

13. Maintenance schedule

FrequencyAction
DailyReview failed mail, screening holds, overdue follow-ups, and backup status.
WeeklyReview unassigned leads, stale conversations, pending transfers, and pending invitations.
MonthlyExport reports, test a sample restore, review users and permissions, and inspect storage use.
QuarterlyInstall tested maintenance releases, audit configuration, and review retention policy.
When staff changesImmediately suspend access, reassign open work, then complete non-destructive deactivation.

Safe update procedure

  1. Read the release notes and confirm server compatibility.
  2. Back up files and database.
  3. Test the update in a staging copy with fictional data.
  4. Place production in maintenance mode if required.
  5. Upload only the documented changed files and run migrations once.
  6. Clear server/browser caches and complete the regression checklist.
  7. Roll back immediately if records, permissions, or mail behavior are inconsistent.
Back to top

14. Troubleshooting

The contact form says “Thank you,” but no lead appears
Verify the form action URL, honeypot value, field names, server log, WAF/ModSecurity result, database connection, and whether the request was held for screening. A generic bot response can intentionally say “Thank you” without creating a lead.
Email notification did not arrive
First confirm the dashboard record exists. Then check the recipient address, spam folder, mail logs, sender authentication, SPF/DKIM/DMARC alignment, and SMTP credentials. Dashboard capture and external email delivery are separate events.
A user sees information outside their role
Suspend the account if exposure is material. Review server-side permission checks, not only hidden navigation links. Removing a button from HTML does not revoke API authority.
A page returns 403 or a security challenge
Confirm the request path and inspect the hosting security log. Ask the host to identify the exact blocked rule for the exact endpoint. Whitelist narrowly; do not disable the web application firewall globally.
Branding preview works but changes disappear
Confirm Preview and Commit are separate actions, the owner has permission to commit, the settings request succeeds, and the saved configuration is loaded after refresh. Clear caches only after confirming the server saved the setting.
The interface works in one browser but not another
Test in a private window, clear the application cache, inspect JavaScript errors, and verify all CSS/JS asset paths and MIME types. Do not assume a browser-specific symptom proves the browser is at fault.
Back to top

15. Support information

Before requesting assistance, record what happened, the exact time, the signed-in role, browser, page address, and visible error. Remove passwords and customer-sensitive data from screenshots.

Include

  • Application version
  • PHP and database versions
  • Exact steps to reproduce
  • Error text and relevant sanitized log entry
  • Whether the issue occurs in a clean session

Do not send

  • Passwords or recovery codes
  • Database credentials
  • Unredacted customer correspondence
  • Complete private configuration files
  • Server backups through ordinary email
SBLocal installation assistanceTeam United may be installed and configured by the client’s authorized website provider or by SBLocal Creative. Standard configuration is distinct from custom workflow development. Integration details and any additional development depend on the client’s server, website, mail provider, business requirements, and approved project scope.

End of Team United Web Lead System Prototype Documentation.