Security & Governance

Tenant-scoped by default

Each authenticated user is mapped to a brokerage tenant. Operational queries are scoped to that tenant at the persistence layer, and private portal routes are excluded from public indexing.

Identity and access

The WordPress authenticated session remains the identity session, while Next Real Estate capabilities determine portal and administrative access. Custom secure access, wrong-password handling, password reset and logout remain inside the branded experience.

Consent as evidence

Consent is stored as a separate dated record rather than a simple contact boolean. That permits capture source, evidence reference and expiry to be retained and evaluated before outbound workflows.

Tamper-evident audit

Operational events can be written to an append-only HMAC hash chain. For regulated production retention, replicate the audit stream to an independent immutable store or SIEM/object-lock service.

AI control plane

AI credentials remain server-side. AI actions should run through the same scoped APIs as human operators and integrations, with explicit policies, rate limits, named human owners and an evaluation process before autonomy is raised.