Before real accounts
How accounts will be secured
None of these are switched on yet. Each must be built and reviewed before real landlord or tenant data is accepted.
Verified email
Not startedNo access until the email address is confirmed.
Password recovery
Not startedEmail reset link and a dedicated reset page.
Google / Apple sign-in
Not startedOnly once configured and tested; not active now.
Property-scoped invitations
Not startedEach tenant or contractor invite is tied to one property and one email, and expires.
Server-side authorisation
Not startedEvery read and write checked on the server, not only hidden in the screen.
Tenant isolation
Not startedTenants see only their own property's shared records; landlords only their own properties.
UK GDPR and retention
Not startedData protection review, retention periods and a deletion process agreed before launch.
Audit logs
Not startedPermanent, unalterable history of who changed what and when.
Signed document handling
Not startedOriginals kept untouched; any real e-signature uses a dedicated service after legal review.
Billing webhooks
Not startedPlan changes only applied from verified payment-provider events.
VAT
Not startedVAT treatment confirmed with an accountant before prices go live.
Stripe integration (later)
Not startedPayments added in a separate, reviewed step.