The Landlord App: Property Management, Built Quality-First
A two-sided property management platform for self-managing UK landlords and their tenants — and a look at how I design a product for reliability, security and long-term growth from day one.
- Status
- Status: Active development · MVP validation
- Role
- Role: Product, architecture, full-stack engineering & QA (solo)
- Timeframe
- Timeframe: 2026 – present

Overview
The Landlord App is a web-based property management platform for self-managing UK landlords — the people running roughly one to ten properties themselves, without a letting agent — and, deliberately, for their tenants too. Rather than landlord software with tenants bolted on as records, it's a genuinely two-sided platform where both sides collaborate.
It's an in-progress product I'm designing and building solo. This case study is less a feature tour than a look at how I think — the decisions, trade-offs and quality discipline behind it — because that's what matters if you're considering working with me.
The problem
Most self-managing landlords run their properties on a patchwork of spreadsheets, email, WhatsApp, cloud folders, paper and memory. Information scatters, and nothing lives in one place. Their tenants, meanwhile, have nowhere central to see documents, track rent, report a repair or reach their landlord — so every interaction is fragmented.
The real cost isn't just wasted time; it's disorganisation and risk. Compliance certificates — Gas Safety, EICR, EPC — quietly expire, and a lapsed certificate isn't mere admin: it can bring fines and can legally block a landlord from regaining possession. Documents get lost, rent disputes come down to “did you pay?” with no shared record, and it all compounds as a portfolio grows.
Why it's different
Most existing tools are single-sided and finance-first — built for the landlord's bookkeeping, with the tenant as a payment record. The Landlord App makes the opposite bet: a two-sided, communication-first platform where landlord and tenant work together. It targets an underserved middle — landlords too big for spreadsheets, too small to justify an agent's fee or enterprise software — and it competes on focus, not feature count, obsessing over the handful of workflows landlords perform every week.
To be clear about scope: today's product isn't a replacement for a letting agent. It's the organisational backbone that makes self-management far easier — the foundation for something larger, built deliberately over time (more on that below).
The six core workflows
Property management
A landlord's whole portfolio, organised in one place.
Tenant management
Tenants onboard themselves through a secure invitation — no accounts created on their behalf.
Document management
Certificates and agreements stored as a single source of truth, shared with tenants only when intended.
Rent tracking — not processing
Landlords record payments; tenants see due, pending or paid, with history — validating the workflow before tackling payments.
Maintenance
Tenants raise issues that move through a clear new → in-progress → resolved lifecycle, visible to both sides.
Communication
Messaging tied to the tenancy, so conversations stay in context with a permanent history — not scattered across apps.
Key engineering decisions (and the trade-offs)
Model the tenancy as a first-class entity
- Why:
- In the real world, properties persist, tenants change, and tenancies begin and end. Making the tenancy the spine — with documents, rent, maintenance and messages living inside it — preserves history and lets a property move cleanly between tenants.
- Alternatives considered:
- Attaching tenants directly to properties is simpler at first, but makes lifecycle changes painful and turns future features like renewals, joint tenancies and HMOs into rewrites.
Enforce authorization at the database layer
- Why:
- Access control is enforced in PostgreSQL itself via Row Level Security, so a tenant can never reach another tenancy's data — even by bypassing the interface and calling the backend directly.
- Alternatives considered:
- Hiding data only in the UI is the common shortcut, and it's fundamentally insecure: anyone who crafts their own request gets everything.
Build it genuinely two-sided from day one
- Why:
- Property management is collaborative, so both landlord and tenant are modelled as active users with their own authentication, permissions and experience. It mirrors reality and creates a stronger foundation.
- Alternatives considered:
- A landlord-only app with tenants as passive records would have been far easier to build — but a weaker product, and expensive to make two-sided later.
Lean on managed services rather than build everything
- Why:
- Using Supabase for authentication, database, storage and security let me spend my limited solo time on user problems, not infrastructure I'd have to build and maintain.
- Alternatives considered:
- Rolling custom auth, storage and a backend would mean more control but a large time sink; the accepted trade-off — some dependence on Supabase — is mitigated because the core is standard PostgreSQL and portable.
Track rent, don't collect it (yet)
- Why:
- Payment processing brings financial regulation, reconciliation, security and third-party integration — none of which is needed to learn whether landlords value the rent-tracking workflow.
- Alternatives considered:
- Integrating payments up front looks impressive, but solves hard problems before validating that anyone wants the workflow.
The hardest part wasn't the code — it was the boundaries
In a platform where landlords and tenants share one system, the challenge isn't writing features; it's modelling ownership, permissions and lifecycle correctly. My instinct, shaped by a decade in QA, is to keep asking “what happens if…” until the design handles the real world, not just the happy path.
The tenant invitation is a good example. It looks trivial — a landlord invites a tenant — until you interrogate it:
Questions I answered before writing a line of code
- What if the tenant already has an account, or registers with a different email?
- What if the invitation is forwarded to someone else?
- How do I guarantee they join the correct tenancy?
- Should invitations expire, or be usable only once?
- What if the landlord removes the tenant before they accept?
- What if a tenant leaves and, later, a new tenant occupies the same property?
None of those were bugs — they were decisions to make before implementation. Working through them turned a simple registration screen into a tenancy-centred invitation model: a secure onboarding mechanism that ties a specific person to a specific tenancy while preserving the permission boundaries that run through the rest of the app.
I don't do this in isolation, either. I use AI as an experienced engineering partner — to challenge assumptions, surface risks and review decisions — while the judgement and direction stay mine. It accelerates the thinking; it doesn't replace it.
Quality, built in from the start
Quality here isn't a phase at the end. A decade in QA taught me the cheapest defect is the one that never gets the chance to exist — so instead of “how will I test this later?”, I ask “how do I design this so it's easier to build correctly and harder to build incorrectly?” That question shaped the stack, the data model and the security model before a single test was written.
In practice, that means defence in depth — strict TypeScript, shared validation schemas, database constraints and Row Level Security — each catching a different class of problem. And I'm precise about where the project stands today: those built-in gates are working now, while broader automated test suites, including tests that prove the access boundaries hold, are the deliberate next step. I'd rather show exactly where it is than imply coverage that isn't there yet.
How it's built
Product & frontend
- Next.js
- React
- TypeScript
- Tailwind CSS
- shadcn/ui
Backend & data
- Supabase
- PostgreSQL
- Row Level Security
- Supabase Auth
- Supabase Storage
Validation & quality
- Zod
- React Hook Form
- GitHub Actions
Where it is today: MVP validation
The product is exactly where I planned for it to be: at the smallest version that can prove the idea, ready to be validated with real landlords before it grows any further. The core is in place — the six workflows, secure onboarding, and database-enforced access control — on a production-quality architecture. This is a deliberate MVP stage, not an unfinished one: the next milestone isn't more features, it's evidence.
So my current work is intentionally narrow — hardening the automated tests around the security boundaries and critical workflows, deploying a stable MVP, and putting it in front of real landlords to learn what genuinely helps them day to day. At this stage a single piece of honest feedback is worth more than another feature, because the job right now is to validate the idea, not to inflate it.
Where it's heading
Beyond validation, the roadmap is sequenced by intent rather than ambition. First, deepen the organisational core — automated compliance reminders so a certificate never lapses unnoticed, richer document and maintenance handling, notifications and reporting. Only later come the higher-complexity capabilities like rent collection and financial tooling, each earning its place by justifying the complexity it adds.
The long-term vision is a genuine “property management company in your pocket” — but I'm careful to hold that as a destination, reached one validated step at a time, not a claim about what exists today. Naming where something is going is easy; the discipline is being honest about how far along the road it actually is.
Why this is a turning point for me
For most of the last decade, my role has been to assure the quality of software that other teams designed and built — finding the risks, strengthening what shipped, and being the person who asks “but what happens if…”. This project is where that role changes shape. Here I own the entire lifecycle: the discovery, the product decisions, the architecture, the engineering, the quality strategy and the deployment, end to end.
That's the transition this represents — from safeguarding other people's products to being fully accountable for one of my own. And it has confirmed something I long suspected: the instincts I built in QA are at their most valuable when they shape a product from its very first decision, not when they're brought in to check it at the end.
What this means if you're hiring me
If you're deciding whether to work with me, this project is the honest answer. It's how I'd approach your product too: start from the real problem your users have, model it faithfully, weigh every trade-off against your goals, and make the decisions today that keep the software cheap to own and safe to change for years.
And it reflects the one belief that runs through everything I build: progress isn't measured by how many features you've shipped, but by how much you can trust what you've built — and that trust is designed in from the very first decision, never bolted on at the end. That's the standard I've held this project to, and exactly the standard I'd hold yours to.
Tags
- Next.js
- TypeScript
- Supabase
- PostgreSQL
- Row Level Security
- Testing
Related projects
Personal2026This Website: A Content-Driven Consulting Platform
I built my own site the way I'd build a client's product — content-driven, fully tested, accessible, and fast. Here's how I approached it, the decisions I made, and what that means for your project.
- Next.js
- TypeScript
- Testing
- Accessibility