Real Estate Management — Security, data storage and audit
Understand tokens, ownership, permissions, public routes, stored tables, file protections, activity and retention responsibilities.
01Apply least privilege to Real Estate ManagementGrant only required view-own/view/create/edit/delete/approval/report/permission capabilities.Admin Area → Setup → Roles02Protect public application tokensTreat invite URLs as bearer links and revoke unused invitations.Admin Area → Tenant Applications → Invitations03Protect agreement countersign tokensSend countersign links only to the intended landlord/signatory.Onboarding workspace → Landlord Countersign04Protect renter identity and income evidenceRestrict access and retention of uploaded identity/income files.Client Renter Profile and Admin review05Protect property-owner and tenant contact detailsAvoid exposing private owner/tenant fields in public descriptions or files.Property/owner/client records06Protect supplier job evidenceRestrict job photos, notes, invoices and payment details.Maintenance & Jobs / Supplier Portal07Protect broker portal accountsUse active unique emails, strong passwords and appropriate broker/company links.Broker Portal and Admin Business Brokers08Review Real Estate stored tablesUnderstand that separate tables store properties, owners, client links, requests, onboarding, maintenance, suppliers, invoices, payouts and notifications.Database-backed module workspaces09Review core table extensionsKnow that roles, staff and items receive module columns.Admin Area → relevant role/staff/property forms10Review property activity and audit evidenceUse module/core activity, onboarding audit and workflow records.Admin Area → source record → Activity/Audit11Review tenant application audit evidenceUse invite/application/audit rows to trace submission and decision.Admin Area → Tenant Applications → open application12Review onboarding audit and workflow evidenceTrace steps, status transitions, messages, documents and signatures.Onboarding workspace → Audit/History13Review supplier and payout audit evidenceReconcile job status/photos/notes with invoice and payment values.Admin Area → Maintenance & Jobs / Supplier Invoices/Payouts14Understand file-storage responsibilitiesUse supported upload/preview/delete actions and secure web-server permissions.Property, profile, onboarding, maintenance and supplier file areas15Understand application retention settingReview the seeded 180-day application-retention value against policy/law.Admin Area → Tenant Application settings16Understand public application consent separationKeep processing/referencing/credit and marketing choices distinct.Public Tenant Application → Consents17Understand no generic Real Estate REST APIDo not expect a documented external REST API from the supplied module.Technical reference → supplied controllers/routes18Understand no Real Estate webhook frameworkDo not expect inbound/outbound webhook configuration from this module.Technical reference → hooks/controllers19Understand no registered Real Estate cron hookDo not expect module background scheduling from the supplied realestate.php registration.CRM Cron and technical reference20Review backup and checkpoint files as excluded artefactsDo not present .bak, .checkpoint, debug logs or error_log files as user features.Deployment package review21Run a Real Estate security reviewTest role boundaries, portal ownership, tokens, files, email, PDF and financial links.Controlled test environment across all roles