01
Row-level isolation
Portfolio and principal boundaries are enforced in Postgres Row-Level Security policies, not only by hiding buttons in the interface.
Security architecture
Trust lives
below the interface.
Financial and resident data deserve controls that still hold when a screen is bypassed. Rentals Ledger builds the boundary into the data layer, server functions, and event paths.
Verified mechanisms
Security controls that exist in the product source.
Plain descriptions, scoped claims, and no borrowed compliance logos.
02
Database-backed roles
Route visibility and actions resolve from permission snapshots backed by the database. Owners, managers, accountants, tenants, vendors, and PM companies receive different boundaries.
03
Server-only authority
Administrative Supabase credentials and provider secrets remain in server or Edge Function environments. They are not imported into browser-delivered modules.
04
Signed event handling
Stripe webhook paths verify signatures against the unmodified raw request body and keep event processing idempotent so retries do not duplicate state.
05
Immutable history
An append-only activity surface records sensitive changes so account owners and financial collaborators can trace who changed what and when.
06
Provider gates
Payment, bank-feed, AI, screening, e-sign, SMS, syndication, and accounting integrations stay behind explicit rollout configuration instead of silently pretending to be live.
Authentication
Identity controls for a multi-role system.
Account protection
Password recovery, invitation integrity, and optional TOTP MFA.
The current authentication flow includes email confirmation, reset-password handling, token-aware invitations, and authenticator-app MFA controls. Role detection routes each authenticated principal into the correct shell.
Boundary principle
A client-side flag can shape rollout. It cannot grant authority.
RLS + server checks remain decisive
Honest boundary
What we do not claim.
No certification theater
This site does not claim SOC 2, ISO 27001, or another independent audit that has not been completed.
Preparation, not filing
Tax reports support preparation. Rentals Ledger does not submit a return to a tax authority.
Configuration matters
A coded integration is not represented as active unless the provider and rollout environment are actually configured.
See the boundary in practice