TenantLens

Overview

A self-initiated build of an internal commercial-real-estate platform that consolidates lease management, NNN expense tracking, and quarterly investor reporting into one place — replacing the Excel + QuickBooks + shared-drive sprawl that CRE operators usually live in. Built end-to-end as a demonstration of how I'd approach the problem; available as a starting point for any CRE operator who wants to use or adapt it.

Highlights

• 5-property demo portfolio with seeded sample data
• Two distinct portals: Admin and Investor (read-only)
• AI-extracted lease + rent-roll data with human-in-the-loop review
• Quarterly investor reports auto-generated to PDF and PowerPoint
• Real-time lease-expiration alerts (90/60/30-day triggers)
• Audit logging on every mutation

The problem

CRE teams cobble together Excel, QuickBooks, shared drives, and signature tools. Lease data lives in PDFs no one re-reads. Quarterly investor reporting takes a week. Lease expirations slip. The opportunity I wanted to demonstrate: everything in one place, with AI handling the tedious extraction work.

Approach

1. 01Modeled the full lease lifecycle in Prisma — amendments and renewals via a self-referential parentLeaseId, soft deletes everywhere for audit integrity.
2. 02Built a document pipeline: upload → parse → AI extract → human review → commit. Reviewers confirm or edit extracted JSON before it touches the database.
3. 03Strict role-based routing (ADMIN vs INVESTOR) with data isolation enforced at the query layer via an InvestorPropertyAccess junction table — investors only ever see their own holdings.
4. 04Money handled as Prisma Decimal (no float drift). Occupancy is computed, never stored. NNN expense changes propagate to active lease terms.
5. 05Quarterly reports rendered server-side with PDFKit + PPTXGEN templates that can be re-skinned for any operator's brand.

Outcome

• Deployed at tenantlens-pilot.vercel.app on Vercel + Neon Postgres + Cloudflare R2 — clickable demo with seeded 5-property portfolio.
• Designed to compress quarterly investor reporting from a week of manual work to a single click.
• Roadmap phased into 7 releases — Phase 7 swaps the mock AI extractor for the real Claude API.

Security

• TOTP-based MFA on the admin login (NextAuth 5)
• Role + ownership checks on every server action
• Soft-delete + audit-log pattern preserves a tamper-evident history
• Per-request CSP nonce + HSTS + strict permissions policy

Stack