Lease management app security checklist

• Tenants see only their own leases, ledger and requests; owners only their properties; vendors only assigned work orders; RLS joins lease_parties and ownership, and financial writes require the manager or accountant role.

• Tenant identity, contact and payment references are encrypted or tokenised, masked in lists and logs, and exported only by authorised roles with audit entries.

• Public enquiry and request forms are rate limited with a captcha fallback; tenant portal links do not reveal other units; error messages do not confirm which emails are tenants.

• Photos and documents are type- and size-validated, EXIF location stripped from shared copies, scanned and served only by signed URLs.

• Lease versions, charges, deposit entries and statements are append only; corrections are new entries with reason and actor and the audit chain is verified nightly.

• Tenancy and deposit law (applies to residential lettings): Deposit protection, notice periods, late-fee limits and entry rights vary by jurisdiction; the app records dates and evidence and does not give legal advice.
• Client money handling (applies to agencies holding funds): Holding tenant and owner funds may require licensing and segregated accounts; phase 1 records movements and uses a payment provider for custody.
• Fair housing and screening (applies to listings): Applicant screening and advertising are regulated for discrimination and credit-reporting rules; screening is deferred.
• Personal data: Tenant data is personal data; apply minimisation, access logging and retention after tenancy ends.

• email per org day: daily outbound email ceiling per organisation, fails closed.
• scanning per org day: daily scan budget per organisation; excess uploads stay unavailable.
• storage gb per org: per-tenant quota for photos and documents.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a lease management app?

Tenants see only their own leases, ledger and requests; owners only their properties; vendors only assigned work orders; RLS joins lease_parties and ownership, and financial writes require the manager or accountant role.

Does a lease management app have compliance obligations?

Tenancy and deposit law, if you have residential lettings: Deposit protection, notice periods, late-fee limits and entry rights vary by jurisdiction; the app records dates and evidence and does not give legal advice. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a lease management app
• Lease management app architecture
• Example prompt for a lease management app
• Lease management app scaling checklist
• Often combined: accounting system
• Often combined: booking system
• All app types