Identity
Role-based access control
Separate policies for owners, agencies, providers, and administrators with least-privilege defaults.
Security posture
Sensitive agreements and property records need enterprise handling.
This application is structured around the assumption that agreements, compliance reports, property data, invoices, and identity artifacts are sensitive. The recommended production posture is private object storage, role-scoped access, signed retrieval, complete audit trails, and staff MFA.
Immediate hosting baseline
- Deploy the web app on Vercel or equivalent with environment-managed secrets.
- Use Supabase Storage or AWS S3 private buckets, never public uploads.
- Enable signed URLs, retention rules, backups, and object access logs.
- Require MFA for admins and rotate secrets on a fixed schedule.
Storage
Private encrypted object storage
Agreements and reports belong in private buckets only, encrypted at rest and retrieved with signed URLs.
Audit
Immutable access trails
All document uploads, views, downloads, and permission changes should be logged for review and retention.
Platform
Hardened deployment posture
CSP, HSTS, secure cookies, environment-managed secrets, malware scanning, and automated backups.
Required controls for production
1
Private buckets only
Store agreements, invoices, property reports, and IDs in non-public buckets with encryption and short-lived signed URL access.
2
Strict access policies
Use per-record authorization tied to authenticated user role and tenancy, never broad path-based public access.
3
Threat monitoring
Enable object-level logging, anomalous download alerts, malware scanning, and immutable retention for signed agreements.
4
Operational hardening
Apply CSP, HSTS, CSRF protection, secure cookies, secrets rotation, MFA for staff, and tested disaster recovery.