Tenant isolation
Row-level security policies restrict rows to the companies a signed-in user actually belongs to, evaluated by the database on every query.
Platform
How it is built
PBS Property is a web application backed by a PostgreSQL database. It is designed around two ideas: one tenant must never see another tenant’s data, and every change must be attributable.
Security model
Access control lives in the database. An interface that forgets to filter is a bug; a database that enforces the boundary is a control.
Authenticated by default
The application requires a session before any application route will load, and anonymous write access to application tables has been revoked.
Non-circular administration
Administrative authority is derived from the user record, not from the membership table it governs, so membership cannot be used to grant itself more authority.
Recorded, not remembered
Changes are written to an append-only audit log at the point they are made, including the values as they were before the change.
Architecture
A deliberately small stack, chosen so that it can be operated by a small team and handed over without a specialist.
- A browser application built with React and TypeScript, type-checked and linted on every build.
- PostgreSQL for storage, with row-level security policies as the access boundary.
- A managed authentication service issuing sessions; the application holds no passwords itself.
- Static assets served over HTTPS from a global edge network.
- Reference data, roles and permissions held as data, so changing them does not require a release.
What we will tell you plainly
PBS Property is a young product built for real portfolios rather than a demo. We will show you what exists today, tell you what is still being built, and let you judge whether the difference matters for your operation.
Hosting region, backup schedule and data-processing terms are agreed in writing before any live data is loaded, not assumed.
Questions about the security model are welcome
If you have a security questionnaire, send it. We would rather answer it properly at the start than discover a mismatch after migration.