A white-label property platform where every agency is its own isolated tenant

The challenge

Multi-tenancy is easy to get subtly wrong. A shared database with per-vendor scoping leaks one agency's leads to another the moment a single query forgets its filter - and that failure is silent, so you find out from a customer rather than from a test. On top of that, every module was gated behind static config flags, which meant a code change and a full deploy to turn anything on, and made per-plan access impossible to sell.

Our approach

Isolation moved out of the controllers and into a middleware layer that resolves the vendor from the request and scopes queries centrally - so a developer cannot forget it at a call site, because there is no call site to forget it at. Feature entitlements moved out of code and into the database, giving two independent levers per feature: a platform-wide master switch and a plan-gated flag, both editable at runtime.

What we built

• Tenant isolation by subdomain, enforced in a vendor-resolver middleware
• Runtime feature registry - enable, disable or plan-gate a module with no redeploy
• Subscription plans with hard server-side limits on listings and agents
• Nine-stage lead pipeline with source attribution across form, WhatsApp, call and chatbot
• White-label configuration per tenant, with live preview of the public site
• Audit logging of every privileged action, including super-admin impersonation

The results

Feature-complete for its v1 scope, with later modules built and held behind flags. The commercial model - what each plan includes - can now change without an engineering release, which was the point. The cover image shows demo data.