Security
Trust is a system property.
RentFlow is built around a simple boundary: the organization context must be known before the operation begins, and the data layer must agree with it.
The controls that matter to operators.
Security should be visible in how the product behaves, not only in a badge on the homepage.
- Organization-scoped database queries
- Database-backed membership checks
- Explicit platform-admin separation
- Hashed API keys with expiry and revocation
- CSRF protection for non-action mutations
- Security headers and production CSP
- Atomic occupancy and billing transitions
- Audit events for financial mutations
A note on readiness
RentFlow’s application controls are actively tested with typecheck, lint, unit tests, build validation, and live schema preflight. Provider-backed subscription billing, backup verification, and a full external penetration review remain deployment work.