Workflow and actors
With engineering, operations, privacy and portfolio owners, we follow leads, KYC documents and owner queries from intake through storage and access, reproduce failures, and agree remediation and retest.
Service · AI code audit · Real estate & property
AI code audit for real estate and property management.
Independent AI code audit for real-estate apps built with v0, Lovable or Cursor. Review KYC data, account isolation, lead APIs and CRM integrations.
The workflows, examples and figures on this page are illustrative composites and modelled targets, not measured client results. In a real project, we define the baseline, thresholds and human review with your data before rollout.
What we solve
The data a real estate firm moves is the data that regulates it.
ID copies for KYC, verifiable income for solvency checks, payslip scans, rental contracts, owner and tenant records, building association files. Real estate firms and property managers handle high-volume, high-value PII. When an AI tool built in six weeks mixes all of that with an unprotected endpoint, what leaks isn’t a bug, it’s a case for a data-protection authority.
We audit the lead funnels, calculators and portals your team built with AI. The lens is sector-specific: GDPR/LOPD-style data protection, lead containment (so a scraper can’t take your portfolio), and account isolation in multi-portfolio managers.
Implementation contract
How it runs in production
Systems and data
Scope may cover forms and portals, APIs, authentication, tables and RLS, buckets, signed URLs, encryption, logs and deletion handling IDs, payslips, contracts, owners, tenants and leads.
Exceptions and risks
We do not download personal documents or enumerate a real portfolio when a synthetic test proves the issue. A public bucket, exposed key or cross-account access is reported for immediate containment.
Human review
Privacy validates retention, access basis and deletion; the business confirms boundaries by agent, office and portfolio; engineering accepts the fix. We close each finding only after reproducible verification.
Implementation pattern
We combine data-flow modelling, code and policy review, ownership tests, storage and secret inspection, and abuse controls such as authentication and rate limiting, using the minimum evidence needed.
Relevant integration
We review actual connections to the CRM, portals, Supabase or other storage and identity services in scope; the audit does not presume access to third-party accounts.
What we build for this sector
Use cases that ship to production.
PII
Custody of IDs, payslips and KYC data
Path of the document from upload to storage. We look for public buckets, guessable URLs, lack of at-rest encryption and filenames that leak identity.
Modelled acceptance target: private bucket · signed URL · encrypted
Leads
Lead isolation across agents and offices
Ownership filters in the leads database. A Madrid agent shouldn't be able to list Valencia leads by changing an ID in the URL.
Modelled acceptance target: no leads outside their account
Anti-scraping
Private listing protected from scrapers
Listing, valuation and contact endpoints behind rate limits, authentication and, where applicable, anti-scraping countermeasures. The target control should prevent portfolio extraction through the API.
Modelled acceptance target: rate limit + auth on every public endpoint
Audit trail
GDPR-style logs for a regulator visit
Who accessed which personal data, when, from where. Retention period, deletion policy, right-to-be-forgotten implemented in code, not just on the privacy page.
Modelled acceptance target: traceability per data point per user
Illustrative composite scenario · modelled figures and targets, not client results
A property manager with 2,300 units under management.
Hypothetical rental property manager with an owners' portal built on Lovable and a tenant-capture bot built on v0. Illustrative composite scenario modelling an audit before an investment process; it does not describe a client, engagement or actual findings.
Modelled audit hypothesis
Modelled risk to test: the interface might show each owner their own units while a public API accepts any owner ID, allowing the portfolio and contact details to be iterated. The tenant-capture bot could also store payslip scans in a Supabase bucket with a USING (true) policy.
Modelled remediation target
Modelled illustrative outcome: an audit could identify 17 findings and prioritise 5 criticals: an ownership filter on the listing, RLS on capture tables, a private payslip bucket with signed URLs, key rotation and a deletion policy implemented in code. The target report would be prepared for data-room review.
Modelled target: 5 criticals remediated before an investment close
We connect to your stack
Integrations that matter in this sector
CRM
HubSpot
Mid-market CRM with broad APIs, a natural fit for sales agents and lead enrichment.
CRM
Zoho CRM
CRM with strong adoption among Spanish SMBs, automations and agents at a contained cost.
COMMS
Microsoft 365 / Outlook
Email, calendar and SharePoint as channel and context, triage, drafting and RAG over your inbox and files.
Frequently asked
What clients ask us
- 01
We handle a lot of PII (IDs, payslips). How do you treat it during the audit?
We only need read-only repository access. We don't copy real data: we work on code structure, database migrations and, when needed, synthetic data. Your PII doesn't leave your infrastructure.
- 02
Does the audit cover GDPR/LOPD compliance?
We look at how the code handles data: where it's stored, retention, whether right-to-be-forgotten is implemented, what flows to logs and external providers. We don't issue a compliance certificate, that needs a DPO or legal auditor, but we produce the material they'll need.
- 03
Do you detect if our private listing is being scraped right now?
We audit endpoints for scraping exposure (no auth, no rate limit, predictable IDs). It isn't real-time monitoring, which is a separate service, but we prioritise controls that reduce that exposure and explain how to validate them.
- 04
Our CRM is Inmovilla / Witei / Idealista CRM. Do you cover those integrations?
Yes. We audit the connector your team built: what permissions it asked for, what objects it can read and write, how it handles auth and errors. If the integration uses provider tokens, we trace where those tokens live.
- 05
What is the end-to-end process, and who closes the audit?
At intake we agree scope, environments and owners. We combine static review with dynamic tests in staging using synthetic data across portals, CRM, PII and storage; the report prioritises findings and assigns each remediation to an owner on your team. We then retest corrected controls, and the property manager's designated owner accepts closure against the agreed criteria.
Same sector, other services
Trust
Safe, traceable AI,
enterprise-ready.
We design for privacy from the start, human control, traceability, usage limits, permissioning and documentation. For sensitive processes, we help assess risk and applicable obligations under GDPR and the EU AI Act.
- 01We never train models on your data without explicit authorization.
- 02Human review built-in for processes where risk demands it.
- 03Traceability: prompts, sources, permissions, errors and metrics, all documented.
- 04Privacy, security and control integrated from day one.
- 05Solutions engineered to be maintained, audited and improved over time.
GDPREU AI ActAEPDISO 27001 readyEU data residency
Personal diagnosis
We work with
few clients.
Every engagement is led personally by one of the partners. If there's a fit, you get a personal first read of your case within one business day, not a canned demo.
How we work
- 01Tell us which process eats your time
- 02Personal reply within one business day
- 0320-minute call, no demo, no pitch