The foundation — multi-tenant isolation

Isolation is not a screen rule; it is a database rule.

The boundary is in the database. Every tenant-owned table is protected by row-level security, and that protection is forced. Permission checks in the application decide what gets rendered; they are not what separates the data.
A bug in a service file cannot leak across tenants. Isolation does not sit above the code layer — it sits beneath it.
Self-service setup. An account is created, then a workspace; ownership, the default buyer and seller pipelines and an empty agency come ready.
Team management. Adding members, changing roles and removing them; roles and permissions ship already defined.

Portfolio management

Properties are listed, searched, created, edited and archived.

The property record. Details are kept in one place; search and filtering run off the list.
Photos. Upload, cover selection and removal; media lives in a private storage bucket.
Archiving goes through approval. Archiving a property is not a one-click affair: the request enters the approval queue and is approved, or rejected with a reason.
AI listing copy. Copy generation is handed only confirmed values; the model cannot invent a characteristic.

Contact records and the sales pipeline live in the same system.

The client file. List, search by role, create, edit, and the full interaction history.
Lead pipeline. Leads live on a board and move between stages; separate buyer and seller pipelines exist by default.
History does not break. Every contact with a client stays in their file; who discussed what, and when, is not lost.

The agency's day reads off one screen.

A two-week agenda. Upcoming appointments and the workload appear together.
Conflict detection. A warning fires at scheduling time; two agents cannot lock the same property into the same slot.
Tasks. A task is added, given a due date, and marked complete.
The day's summary. The home screen brings together today's appointments, tasks, new leads and active properties.

This is the reputational core of the product, and these rules do not bend.

AI cannot write a property fact. Model output lands in a separate suggestion record and stays inert until a person accepts it. The listing writer is handed only confirmed values.
No fabricated characteristics. No factual attribute is altered in a way that could mislead a buyer.
Every generated image keeps its origin. A derived asset must name the original it came from and record how it was made; that provenance is made immutable at the database level.
Labelling is mandatory. Original Photo, Enhanced Photo, Virtual Staging, Renovation Visualization and AI Concept are kept apart — a renovation visualization cannot be relabelled as a photograph, even by someone with edit rights.
Detected fact, inferred information and stated fact are separated. An inference does not become a listing statement without human confirmation.

What happens when the system gets something wrong is defined in advance.

Approval engine. Sensitive actions — outbound messages, publishing, expensive generation, deletions — route through an approval flow; the queue works, rejection with a reason included.
Audit trail. The record is append-only; it is not edited after the fact.
Soft deletes and retention. The schema supports soft deletes, the audit trail and recorded consent — the policy that meets your GDPR obligations is yours to set, and the infrastructure is ready for it.
Feature flags. Large features open behind a flag; a capability switched on at one agency does not affect another.
The tests run real SQL. The suite starts an actual database, applies every migration in order, and runs the assertions as real users under real policies. Add a table without row-level security and the suite fails.

Multilingualism is not a layer bolted on afterwards; it is a property of the architecture.

French, Dutch, English and Turkish. All four are complete across every screen; the user picks their own.
No hard-coded strings. No user-facing text is written into the code; the catalogues are compared key by key.
Adding a language is a small job. One configuration entry, one catalogue and one migration; the type system finds the rest — an incomplete language does not compile.

This page describes only what runs today. What is next is announced as next.

What runs. Sign-up and sign-in, workspace and team, properties and photos, approvals, clients, lead pipeline, calendar and tasks, audit trail, multi-tenant isolation and four languages.
Waiting on a provider. Photo enhancement, virtual staging and renovation views depend on choosing an image provider; e-mail invitations and messaging channels depend on provider configuration.
Later phases. Marketing, documents, transactions, memory and insights are still to come; their screens say so plainly — no button hides a feature that is not there.
Why we write it this way. The decision to buy agency software should not rest on the promise of a feature that does not exist.

Workspace. The account is created, then your agency's workspace; ownership and default pipelines come ready.
Team. Your agents are added with their roles; what each can see follows from the role.
Portfolio and client migration. Your existing properties and client records are imported, and photos are uploaded into private storage.
Pilot week. One real week with a single team: real leads, real viewings, real conflicts.
Going live. The production environment, e-mail confirmation, the content security policy and retention rules are reviewed together before opening.

The agency is the data controller. For the client, property and communication data entered into the system, the data controller is the estate agency using it. K-SAT processes that data only as a processor, within the scope of the contract.
The retention and deletion policy is yours. The schema supports soft deletes, the audit trail and recorded consent; setting the GDPR policy — which data, for how long — is the agency's obligation.
The agency is responsible for listing accuracy. The system prevents AI from writing a property fact on its own and hands the model only confirmed values; even so, the accuracy and regulatory compliance of the published listing remain the agency's responsibility.
A generated image's label cannot be removed. Every derived asset carries its origin and how it was produced, and that record is made immutable at the database level. Publishing while hiding that label, or using it misleadingly, is the user's responsibility and may breach consumer law.
Sub-processors. Hosting, storage and AI model providers act as sub-processors; the current list is kept as an annex to the contract and any change is notified in advance.
Image rights. You confirm that you hold the usage rights to the photographs uploaded into the system; claims arising from third-party images rest with the party who uploaded them.