A full-stack multi-tenant SaaS platform for urbanisations, gated communities, and HOAs worldwide. From digital AGM voting and community fee collection to facial recognition gate access and a purpose-built F&B module. Founded at Señorio de Marbella, Marbella — Community #1.
15
Community Roles
4
Subscription Plans
€49
Starting From / Month
23
Competitors Analysed
The Challenge
Gated communities, urbanisations, and HOAs worldwide are run on spreadsheets, WhatsApp groups, and paper AGM minutes. Community fees go unpaid for months — nobody knows who owes what. Facility bookings happen via text message. Maintenance issues fall through the cracks. Gate access codes are shared on Post-it notes. Board meetings produce resolutions that nobody can find six months later.
At Señorio de Marbella — a 400-unit urbanisation on the Costa del Sol — these problems were documented in exhaustive operational detail. What emerged was not a feature request list. It was a product vision: an operating system purpose-built for how residential communities actually work. Every module in this platform traces directly to a real operational failure observed on site.
After analysing 23 competing platforms globally, 10 significant market gaps were confirmed. No competitor offers a purpose-built F&B module. None combine digital voting with legally defensible step-up authentication. None ship a unified mobile app that adapts to every role — from board president to tourism renter — on login. This platform does all of that, built for the EU from day one.
What Is Being Built
Technology Stack
Every technology decision was made for a reason: ASP.NET Core 10 for the API performance and EF Core migrations, React Native for a single mobile codebase across all roles, PostgreSQL JSONB for multilingual content storage without a separate translations table.
API Backend
Web Frontend
Mobile App
Database
ORM & Migrations
Authentication & 2FA
Billing & Subscriptions
Real-Time
Facial Recognition
Hosting & Infrastructure
Platform Modules
Row-level isolation — every database table has a tenant_id foreign key. Subdomain routing resolves the tenant on every request. The tenant is always sourced from the JWT claim, never from URL params or request body. Cross-tenant data leakage is architecturally impossible.
15 distinct roles from Platform Admin to Tourism Renter. The JWT role claim drives the entire experience — which navigation stack loads on mobile, which data is visible, which actions are permitted. Board members and a gardener log into the same app: they see completely different interfaces.
One app, every role. Role-determined navigation stack renders on login. WatermelonDB for offline queue — announcements and shift clock-ins work without signal. JWT stored in Expo SecureStore, never AsyncStorage. Pusher Channels for real-time push.
Stripe-powered fee collection per property. Automated reminders at 7, 3, and 1 days before due. Overdue tracking with management dashboard. Resident self-service payment portal — pay directly from the mobile app or web. Full per-property ledger history.
Full AGM voting with step-up 2FA for ballot integrity — residents must re-authenticate before casting a vote. Quorum tracking in real time. Results publication with full audit trail. Resolution archive linked to the document vault. Legally defensible in Spanish LPH jurisdiction.
Swimming pools, padel courts, BBQ areas, event rooms, yoga terraces. Capacity limits enforced, conflict detection prevents double-booking, management approval workflows for premium slots. Resident self-service from app or web with instant confirmation.
AGM minutes, community rules (estatutos), contracts, insurance policies, architectural plans. All backed by GCP Cloud Storage. Role-gated access — residents see what residents should see, board members see everything. Multilingual filename support.
A purpose-built bar and restaurant operations module — the only one of its kind in any urbanisation platform on the market. Revenue tracking per session and event night, shift management for F&B staff, supplier contacts, event scheduling, and weekly performance reporting. Built from real operational intelligence at Señorio de Marbella's Hibiscus Bar.
Spanish and English at launch. French, Arabic, Portuguese next. RESX files on the API (IStringLocalizer), i18next on the React SPA and mobile app. Database content stored as JSONB — {"en":"...","es":"...","fr":"..."} — one column, every language, no joins required.
Owners issue digital guest passes from the app — no account required for the visitor. The pass is a signed JWT (48h expiry) embedded in a QR code. It contains the WiFi password, permitted amenities, and emergency contacts. Security staff scan it at the gate on their mobile app.
Staff clock-in by face via Azure Face API (West Europe, GDPR-compliant). Confidence ≥ 0.85 = auto clock-in, creates shift record. Confidence 0.60–0.84 = identity confirmation prompt. Below 0.60 = QR pin fallback. Face vectors stored in Azure only — local DB holds the UUID reference, never biometric data.
Intercom panel with camera sends frames to Azure Face API for identification. Residents enrol via mobile app: 3 photos, under 60 seconds. GDPR Article 9 biometric data consent recorded at enrolment. Confidence threshold for gate open: configurable per community.
Residents report maintenance issues via app — photo attachments, location within the community, category. Management assigns to the correct maintenance staff member. Priority levels, status updates, resolution notes. Full issue history per property.
Platform enforces minimum 2FA policies that tenants cannot weaken. Board president and above: TOTP or SMS required. Step-up authentication for critical operations: e-voting, payment method changes, legal document signing. Tenants can strengthen but never weaken the platform minimums.
Every Stripe invoice.payment_succeeded webhook automatically calculates and records the founder revenue share: 15% for Spain and Portugal tenants, 3% for all other markets. Aggregated quarterly. Señorio de Marbella board receives a living revenue dashboard.
Residents ask questions in natural language — rules queries, facility information, fee explanations. The assistant handles common questions and escalates to management when needed. Trained on each community's specific documents and rules.
Tenant signup creates a Stripe customer and subscription automatically. Webhook handlers manage the full lifecycle: activation, plan changes, failed payments (7-day grace), cancellation (7-day grace before deactivation). All prices in Stripe — never hardcoded. Idempotency keys on all API calls.
All data stored in GCP europe-west2. Azure Face API uses West Europe region. Soft deletes throughout — no hard deletes on user or tenant data, 90-day retention after cancellation. Biometric consent recorded at enrolment (GDPR Article 9). LOPD (Spain) compliant. No data ever written to US regions.
System Architecture
/urbanisation-platform (monorepo)
│
├── src/
│ ├── Api/ ASP.NET Core 10 Web API
│ │ ├── Controllers/ Tenant-scoped REST endpoints
│ │ ├── Middleware/
│ │ │ └── TenantResolutionMiddleware.cs ← runs first, every request
│ │ └── Program.cs
│ │
│ ├── Core/ Shared library
│ │ ├── Entities/ EF Core (all extend TenantEntity)
│ │ │ ├── Announcement.cs title_translations (jsonb)
│ │ │ ├── Booking.cs · CommunityFee.cs · Issue.cs
│ │ │ └── ... 15 tenant-scoped entities
│ │ └── Data/AppDbContext.cs global query filters (soft deletes)
│ │
│ └── Web/ React 18 + Vite SPA
│ └── src/
│ ├── api/ Typed fetch wrapper (no direct fetch in components)
│ ├── pages/
│ │ ├── resident/ Property owners + tenants
│ │ ├── management/ Board + operations staff
│ │ └── admin/ Platform super-admin
│ └── i18n/ i18next (es + en, JSONB fallback)
│
├── mobile/ React Native + Expo (all roles, one app)
│ └── src/
│ ├── navigation/
│ │ ├── GovernanceStack.tsx Board + legal (voting, AGM, financials)
│ │ ├── OperationsStack.tsx Maintenance + security + F&B
│ │ ├── ResidentStack.tsx Owners + tenants
│ │ └── GuestStack.tsx Tourism renters — QR pass only
│ ├── store/ Zustand (mirrors web state shape)
│ └── db/ WatermelonDB offline queue
│
└── docker/ + cloudbuild.yaml GCP Cloud Build → Artifact Registry → Cloud RunTenant Isolation is Absolute
Every database table has tenant_id. Every query filters by it. The tenant is always resolved from the JWT claim — never from URL parameters, query strings, or request body. TenantResolutionMiddleware runs before every controller on every request.
One API, Three Clients
ASP.NET Core 10 serves the React SPA, the React Native mobile app, and the platform admin dashboard from a single API with a single JWT standard. No separate mobile API. Same endpoints, same auth, same tenant isolation — the role claim determines what each client can see and do.
Role-Driven Everything
A board president and a gardener log into the same mobile app. The JWT role claim renders the correct navigation stack, hides irrelevant data, and enforces server-side authorization policies on every endpoint. No feature flags, no client-side role checks that can be bypassed.
Built for GDPR from Day One
All infrastructure in europe-west2. Soft deletes throughout — no hard deletes on user or tenant data. Biometric consent recorded at enrolment. LOPD (Spain) and GDPR Article 9 compliant. GCP Secret Manager for all credentials — nothing in config files or environment variables in source control.
Subscription Plans
From a 30-unit apartment complex to a 500-unit resort urbanisation. Pricing designed so the platform pays for itself inside the first month of reduced admin overhead.
Basic
€49/mo
Up to 50 units
Standard
€99/mo
Up to 200 units
Premium
Most Popular€199/mo
Up to 500 units
Enterprise
€349/mo
Unlimited units · Custom domain
All plans include a revenue share arrangement with Señorio de Marbella as Founding Partner: 15% of net subscription revenue for Spain and Portugal communities, 3% for all other markets, paid quarterly once the balance exceeds €500.
Global Reach
5
Target Launch Markets
15
User Roles
€349
Enterprise Plan / Month
100%
EU Data Residency
Launch Roadmap
Q4 2026
Spain
LPH · SEPA · es
Q1 2027
Portugal
pt · SEPA
Q2 2027
UAE / GCC
ar · AED
Q3 2027
Latin America
es/pt · PIX
Q4 2027
France / EU
fr · SEPA
We are building the platform that communities worldwide have been waiting for. Señorio de Marbella, Marbella, is Community #1. If you manage an urbanisation, HOA, or gated community and want early access — or if you want to build something similarly ambitious — let's talk.