TenantLens

Overview

An internal commercial-real-estate platform that consolidates lease management, NNN expense tracking, and quarterly investor reporting into one place — replacing the Excel + QuickBooks + shared-drive sprawl that CRE operators usually live in.

Highlights

• 5-property pilot portfolio
• Two distinct portals: Admin and Investor (read-only)
• AI-extracted lease + rent-roll data with human-in-the-loop review
• Quarterly investor reports auto-generated to PDF and PowerPoint
• Real-time lease-expiration alerts (90/60/30-day triggers)
• Audit logging on every mutation

The problem

CRE teams cobble together Excel, QuickBooks, shared drives, and signature tools. Lease data lives in PDFs no one re-reads. Quarterly investor reporting takes a week. Lease expirations slip. The pilot client needed everything in one place — and they needed AI to handle the tedious extraction work.

Approach

1. 01Modeled the full lease lifecycle in Prisma — amendments and renewals via a self-referential parentLeaseId, soft deletes everywhere for audit integrity.
2. 02Built a document pipeline: upload → parse → AI extract → human review → commit. Reviewers confirm or edit extracted JSON before it touches the database.
3. 03Strict role-based routing (ADMIN vs INVESTOR) with data isolation enforced at the query layer via an InvestorPropertyAccess junction table — investors only ever see their own holdings.
4. 04Money handled as Prisma Decimal (no float drift). Occupancy is computed, never stored. NNN expense changes propagate to active lease terms.
5. 05Quarterly reports rendered server-side with PDFKit + PPTXGEN templates the client can re-skin.

Outcome

• Pilot deployed at tenantlens-pilot.vercel.app on Vercel + Neon Postgres + Cloudflare R2.
• Demo seeds a full 5-property portfolio so prospects can click around without onboarding.
• Roadmap phased into 7 releases — Phase 7 swaps the mock AI extractor for the real Claude API.

Security

• TOTP-based MFA on the admin login (NextAuth 5)
• Role + ownership checks on every server action
• Soft-delete + audit-log pattern preserves a tamper-evident history
• Per-request CSP nonce + HSTS + strict permissions policy

Stack