Vibe coding for CMOs in professional services.
A CMO at a law firm, an agency or a consultancy sells expertise through work the firm is often not allowed to name. The tension is that every proposal, case study and bio wants to cite a client, and the engagement letters, the bar's advertising rules and the partners who must approve each word all say the same thing: not without a record of permission.
What is true about software in professional services before you write a prompt.
Agencies, consultancies, law firms and accounting practices sell time and expertise, and most of their software is a compromise: the practice management system, the time tracker, the client portal that nobody likes. Executives at these firms are building their own: a client dashboard, a proposal generator, an intake workflow, a utilisation report. Every one holds client confidential information.
Client confidentiality is the business
A tool that lets one client see another's project, or exposes a document to the wrong staff member, ends a relationship and possibly a licence. Access control per client is the first thing to build and the first thing to check.
The engagement letter has terms about data
Clients often specify where their data may be stored and who may process it. A tool on a personal hosting account in the wrong region breaches contracts the firm signed.
Billing must reconcile
Time, rates, expenses and invoices have to agree with the accounting system. A utilisation tool or a billing dashboard that drifts from the books causes arguments with clients and auditors.
Professional rules apply to software
Legal privilege, accounting standards and industry codes constrain how records are kept and who may access them. The tool has to fit those rules, not the other way round.
What a CMO in professional services builds first.
01The client permission register
Which logos, names and case results may be used, who at the client approved it, and when the permission expires. Built first because it is the question every proposal starts with and nobody can answer.
02The proposal and credentials generator
Pulls approved case studies, team bios and rates into a branded proposal in minutes, reading only from the permission register. Pitch teams currently rebuild this from old decks at midnight.
03The thought leadership publishing workflow
Drafts from partners, a review step for conflicts and the disclaimers the profession requires, then publishing and distribution tracking. Attorney advertising rules make a missed disclaimer a bar complaint.
CMOs in every industry tend to build the same four things. The CMO page has that list.
The proposal generator names a client that forbade it
The generator pulled every matter from the practice management system because that was the easiest source, and a pitch to a prospect included a case study naming their direct competitor, whose engagement letter prohibits disclosure. The prospect mentions it to the client. The firm loses the relationship, faces a breach claim, and the partner who signed that letter finds out from the client.
The pattern underneath is the one every CMO hits: every email and phone number a visitor typed sits in a database the AI set up with default settings. The admin page has no login, or the export URL has no check. Marketing just became the source of a data breach.
What a safe build in professional services usually runs on.
Builds run on a standard web stack with Postgres, private document storage, single sign-on for staff and a scoped client login, and integrations with the practice management, time and accounting systems through read-only keys where possible. Client-facing pages are separated from internal ones from the start.
What changes for a CMO in professional services.
A CTO in your corner reads every public page and every form before it ships. Where the data goes, who can read it, whether the keys are hidden, whether the page will survive the launch traffic. You still build at campaign speed. You just never have to explain to legal why the lead list was public.
What CMOs in professional services ask.
A CTO who has read professional services apps before yours.
Thirty minutes, free, no card. What you built, what is going on with it, whether we can help.
In your corner.