SETTINGS
The Settings module is the central configuration layer for a landlord or real estate company on Leaseora. It provides one place to manage account identity, operating defaults, notification rules, integrations, security controls, enabled modules and client-facing preferences. The module is not only a page of switches: it connects the company profile, user profile, grouped setting records, security dashboards, notification centres, external webhooks, mobile profile services and platform-wide Super
|
LEASEORA SETTINGS End-to-End User and Technical Operations Guide Company • Notifications • Property Defaults • Payments • Reporting • Integrations • Modules • Security • Client Settings |
For real estate companies, corporate landlords, private landlords, property managers, finance, legal, security and operations teams
Version 1.0 | July 2026
|
Purpose of this guide |
|
Item |
Details |
|
Document title |
Leaseora Settings Module User and Technical Operations Guide |
|
Version |
1.0 |
|
Date |
July 2026 |
|
Primary audience |
Real estate companies, corporate and private landlords, property administrators, finance, legal, security, IT, compliance, customer support and operations teams. |
|
Client audience |
Private and corporate clients who manage profile, privacy, notifications, billing, connected devices and IoT preferences through web or mobile. |
|
Technical coverage |
Setting model, landlord settings controller, company and profile controllers, notification controllers, security controllers, wallet security, SuperAdmin settings, tenant/client settings, integration webhooks and related service testing. |
|
Terminology |
This guide uses Client in user-facing explanations. Backend class names and routes that use Tenant are preserved exactly in technical sections. |
· Business users should begin with Sections 1 to 5, then follow the numbered operational steps in order.
· Department heads should use the permissions, governance, review cadence and go-live sections to define internal controls.
· Security and IT teams should study the advanced security, integrations, webhook and technical-reference sections.
· Product and engineering teams should preserve the supplied controller, model, method and setting-group names when validating the live build.
· Defaults shown in this guide are the values supplied in the Settings module specification. Any difference in the production interface should be confirmed against the current code and configuration before training users.
|
Configuration changes affect operations |
The Settings module is the central configuration layer for a landlord or real estate company on Leaseora. It provides one place to manage account identity, operating defaults, notification rules, integrations, security controls, enabled modules and client-facing preferences. The module is not only a page of switches: it connects the company profile, user profile, grouped setting records, security dashboards, notification centres, external webhooks, mobile profile services and platform-wide SuperAdmin defaults.
|
Item |
Description |
|
Primary audience |
Corporate landlords, real estate companies, private landlords, property administrators, finance, legal, security, IT, compliance, customer support and senior management. |
|
Core scope |
General, notification, appearance, communication, property, client, payment, reporting, integration, localization, backup, module, feature and security configuration. |
|
Advanced security scope |
TOTP-based two-factor authentication, backup codes, IP whitelisting, fraud analysis, anomaly scanning, security events, active sessions, access-control review, audits and session revocation. |
|
Wallet security scope |
Wallet fraud alerts and patterns, investigations, risk dashboard, transaction-limit validation, IP logging, audit logs and 2FA status. |
|
Client scope |
Profile, password, photo, privacy, notifications, billing, connected devices, account deletion and IoT preferences. |
|
Platform scope |
SuperAdmin defaults and testing for notification, payment, email, KYC, AI, wallet, Mofi, authentication pages, webhook monitoring and security compliance. |
|
Technical scope |
Models, controllers, methods, setting groups, updateOrCreate persistence, default merging, cache invalidation and inbound/outbound integrations supplied in the specification. |
Settings Terminology
|
Term |
Meaning |
|
Setting key |
The unique name of a configurable option, such as default_currency or two_factor_auth. |
|
Setting group |
The section namespace used to organise related keys, such as landlord_payment or landlord_security. |
|
Setting value |
The saved value for the key. The value may represent text, a number, a Boolean, a date/time option or a selected choice. |
|
Default value |
The value returned when no user-specific Setting record exists. |
|
Effective setting |
The value actually shown and used after stored records are merged with defaults and, where applicable, Company or User profile data. |
|
Module toggle |
A control that enables or disables an entire Leaseora module and affects navigation visibility. |
|
Feature toggle |
A granular control that enables or disables a specific capability inside an enabled module. |
|
Platform default |
A SuperAdmin-controlled value that establishes system-wide behaviour or new-account defaults. |
|
Client/Tenant |
The person or organisation using Leaseora services. “Tenant” remains in backend controller and class names. |
|
Important boundary |
|
Role |
Main responsibilities |
Key controls |
|
Corporate Landlord / Real Estate Company |
Owns the account configuration, company identity, enabled modules, operating defaults and business approvals. |
Maintains approved values and delegates only the access required. |
|
Private Landlord |
Configures personal-landlord settings, defaults, notifications, payments and security. |
Keeps profile and payment information accurate and secures the account. |
|
Company Administrator |
Maintains company profiles, adds or removes users, updates general settings and coordinates changes. |
Should not approve its own high-risk security, financial or legal exceptions without review. |
|
Property / Lease Administrator |
Uses property, client, lease, inspection and document defaults. |
Confirms that defaults are appropriate before creating live records. |
|
Finance Team |
Controls currency, tax, late fees, partial payments, invoices, billing, wallet and financial report settings. |
Reconciles configuration to contracts, accounting and payment-gateway rules. |
|
Legal / Compliance Team |
Reviews terms, retention, auto-renewal, screening, guarantor, insurance, notification and data controls. |
Confirms applicable-law and contract compliance. |
|
Security / IT Team |
Manages 2FA, sessions, IP rules, activity logs, integrations, webhooks, devices, backups and incident response. |
Uses change control, tests connectivity and avoids locking out authorised users. |
|
Marketing / Communications |
Maintains email signature, auto-reply, read receipts and relevant notification defaults. |
Uses approved brand and client-communication wording. |
|
Customer Support |
Guides users through settings, notifications, devices and profile issues. |
Cannot bypass security controls or make unauthorised finance/legal changes. |
|
Client / Tenant |
Manages personal or corporate profile, privacy, notification, billing, devices and IoT preferences. |
Uses accurate information and protects account credentials. |
|
Leaseora SuperAdmin / Support |
Configures platform defaults, service connections, testing and monitoring. |
Does not replace the real estate company’s internal approvals and business decisions. |
Figure 1. Settings module end-to-end configuration journey
|
Phase |
Business outcome |
Main records / controllers |
|
1. Account foundation |
Company identity, profile and locale are accurate. |
Setting, User, Company, CompanyController and profile controllers. |
|
2. Operating defaults |
Notifications, communication, property, client, payment and report defaults are approved. |
Landlord Shared SettingsController and grouped Setting records. |
|
3. Integration enablement |
Approved API, webhook, calendar, accounting, automation and AI connections are configured and tested. |
Integration settings and webhook/service-test controllers. |
|
4. Security hardening |
2FA, sessions, IP rules, activity logs, fraud controls and wallet protections are applied. |
SecurityManagementController, SecurityController and WalletSecurityController. |
|
5. Module tailoring |
Only required modules and features are visible and available. |
modules and features setting groups plus updateModules / updateFeatures. |
|
6. Governance and support |
Changes are saved, validated, audited and reviewed for landlord and client use. |
SettingsController@update, caches, audit data, client settings and SuperAdmin controls. |
All landlord settings are represented as key-value records in the Setting model. The key identifies the option, the group identifies its settings section, the type describes how the value should be interpreted, and the description explains the purpose. User-specific records are saved with the authenticated user ID so separate landlords can use different configurations.
Figure 2. Effective-setting resolution
How getSettingsWithDefaults Works
1. The section method defines the expected setting keys, types and default values.
2. getSettingsWithDefaults($group, $definitions) fetches saved Setting records for the requested group.
3. Saved records are matched to their keys and merged into the section definitions.
4. Where a key has no saved record, the supplied default remains the effective value.
5. For selected General, Property and Client defaults, values may initially be pulled from the Company or User model.
6. The resulting effective settings are returned to the view so every form field has a usable value on first access.
|
Setting model field |
Purpose |
Operational control |
|
key |
Unique name of the setting. |
Do not reuse the same key for unrelated purposes within the same group. |
|
value |
Saved configuration value. |
Validate and normalise according to the declared type. |
|
group |
Settings section namespace. |
Keep landlord, platform, client and feature groups clearly separated. |
|
type |
Expected field or data type. |
Boolean, text, number, email, URL, time, textarea or select as defined. |
|
description |
Human-readable explanation. |
Use descriptions to support training, review and administration. |
|
user_id |
Authenticated owner of the setting where user-scoped updates are used. |
Ensures one landlord’s values do not overwrite another landlord’s settings. |
|
Defaults are not saved automatically |
|
Profile data and settings must remain aligned |
Business Information to Prepare
· Approved legal or trading company name, primary contact email, phone, website, tax ID and business address.
· List of company entities and the users who should access each entity.
· Company timezone, country, language and date/time display standards.
· Approved property, lease, inspection, pet, smoking, insurance, screening, guarantor, co-signer and renewal policies.
· Approved transaction currency, tax rate, late-fee method, late-fee amount, grace period and partial-payment policy.
· Invoice-generation and report-distribution rules, fiscal-year start, recipients and file formats.
· Integration inventory, owners, webhook URLs, credentials, verification secrets and test plans.
· Backup frequency, retention, file inclusion and encryption requirements.
· Module and feature entitlements for the company plan and operating model.
· Security policy covering 2FA, session duration, password expiry, login alerts, IP restrictions, activity logging and wallet controls.
· Change approvers, test users, support contacts, rollback process and review cadence.
Recommended Implementation Sequence
1. Create or verify the company profile and all authorised users.
2. Configure localization before validating dates, times, reminders and reports.
3. Set General, Notification, Appearance and Communication preferences.
4. Approve Property, Client, Payment and Reporting defaults.
5. Enable only the required modules and features.
6. Configure integrations in a controlled test environment and verify each connection.
7. Enable 2FA and security controls, then confirm recovery and session-revocation procedures.
8. Configure backups and confirm responsibility for restoration testing.
9. Test the settings with one pilot property, one staff role and one client account.
10. Complete user acceptance testing, record approvals and then roll out to the wider company.
|
Use individual accounts |
|
High-impact settings need approval |
Steps 1 and 2: enter the configuration hub and establish the company identity that appears across Leaseora.
|
STEP |
Access the Settings Dashboard |
Expected result: The Settings Hub opens with all authorised configuration sections and current effective values.
Log in to the landlord account and navigate to Settings at /settings. Landlord\Shared\SettingsController@index returns the Settings Hub view at users.landlord.shared.settings.hub. The controller uses the HasBreadcrumbs trait so users can navigate back to the dashboard and between settings sections consistently.
What the Settings Hub Contains
|
Section |
What it controls |
Typical owner |
|
General |
Company name, contact details, website, tax ID and address. |
Company Administrator / Director |
|
Notifications |
Email, SMS, push, quiet hours and event alerts. |
Operations / Customer Support |
|
Appearance |
Theme, compact mode, sidebar and pagination. |
Individual user / Administrator |
|
Communication |
Email signature, auto-reply and read receipts. |
Communications / Customer Support |
|
Property |
Lease term, maintenance threshold, inspections, pets, smoking, insurance and deposit. |
Property / Lease Operations |
|
Client |
Screening, renewal reminders, welcome email, guarantors, co-signers, expiry reminders and auto-renewal. |
Leasing / Compliance |
|
Payment |
Currency, tax, late fees, grace period, partial payments and invoices. |
Finance |
|
Reporting |
File format, fiscal year, scheduled email reports, frequency and recipients. |
Finance / Management |
|
Integration |
API, webhooks, Slack, Google Calendar, QuickBooks and Zapier. |
IT / Integration Owner |
|
Localization |
Timezone, date/time format, language and country. |
Administrator |
|
Backup |
Automatic backup, frequency, retention, files and encryption. |
IT / Security |
|
Modules |
Enable or disable complete platform modules. |
Director / System Administrator |
|
Features |
Enable or disable granular capabilities. |
Product Owner / Administrator |
|
Security |
2FA, sessions, login alerts, password expiry, IP whitelist and activity logging. |
Security / IT |
Dashboard Review Procedure
1. Confirm that the signed-in company and user account are correct before editing anything.
2. Review the available sections against the user’s role. A user should not see or change sections beyond their authority.
3. Open each section and compare the displayed effective values with the company’s approved configuration register.
4. Identify settings that are still using defaults and decide whether the defaults are acceptable or must be explicitly saved.
5. Record high-impact changes before editing, especially payment, integration, module, feature and security settings.
6. Save one section at a time and confirm the success message and operational result.
|
A visible value may be a default |
|
|
STEP |
Configure General and Company Settings |
Expected result: Company identity and primary contact information are accurate and available to related workflows.
Open Settings -> General. SettingsController@general prepares the landlord_general section. Initial values are pulled from the linked Company model where available and fall back to the User model for selected fields. When saved, each field is persisted as a grouped Setting record through updateOrCreate.
|
Setting key |
Type |
Source / purpose |
Control |
|
company_name |
text |
Company or trading name from Company.company_name or User.company_name. |
Use the approved legal or customer-facing name according to company policy. |
|
contact_email |
email |
Primary contact from Company.email or User.email. |
Use a monitored company mailbox; verify spelling and delivery. |
|
contact_phone |
text |
Primary contact from Company.phone or User.phone. |
Include the correct country code where required. |
|
website |
url |
Company website from Company.website. |
Use the official secure website address. |
|
tax_id |
text |
Tax Identification Number from Company.tax_id. |
Restrict editing to authorised finance or compliance staff. |
|
address |
textarea |
Business address from business_address, address or User.address. |
Use the official operational or registered address required by the company. |
Procedure
1. Open General settings and compare the displayed company against the account header or company dashboard.
2. Enter or correct the company name, email, phone, website, tax ID and address.
3. Check that the contact email is accessible to the team responsible for client and platform communications.
4. Verify the website URL and phone format.
5. Confirm whether the change should also be applied to the underlying Company or User profile in the live implementation.
6. Save the section and reopen it to confirm the stored values are returned.
7. Review a sample outbound communication or profile page to confirm the correct identity is displayed.
Company Management Functions
|
CompanyController action |
Purpose |
Business control |
|
index |
View companies linked to the landlord. |
Confirm the user is working in the correct legal entity. |
|
create / store |
Create a new company profile. |
Use approved entity information and avoid duplicates. |
|
show |
View company details. |
Review before editing users or settings. |
|
edit / update |
Change company profile information. |
Record material legal or tax changes. |
|
destroy |
Delete a company. |
Confirm no active users, properties, leases, billing or records depend on it. |
|
dashboard |
Open the company-level management dashboard. |
Use for per-entity oversight. |
|
manageUsers |
View users associated with the company. |
Review least-privilege access. |
|
addUser |
Grant company access to a user. |
Verify identity, role and manager approval. |
|
removeUser |
Revoke company access. |
Remove access promptly when no longer required. |
|
summary |
View the corporate portfolio summary where supplied. |
Confirm figures and entity filters. |
Profile Paths
|
User type / controller |
Functions |
|
CorporateLandlordProfileController |
show and store corporate profile information. |
|
PrivateLandlordProfileController |
show and store private landlord profile information. |
|
Shared\ProfileController |
Shared profile management across supported user types. |
|
MobileProfileSettingsController |
Profile retrieval, personal information, photo, password, phone, email, privacy, activity, devices and account deletion. |
|
Avoid conflicting identity records |
Steps 3 to 5: configure how the company receives alerts, how the interface is displayed and how routine messages are presented.
|
STEP |
Configure Notification Preferences |
Expected result: Approved alert channels, quiet hours and event notifications are active for the landlord account.
Open Settings -> Notifications. SettingsController@notifications loads the landlord_notifications group. These settings define the landlord’s preferred alert channels and selected operational events.
|
Key |
Type |
Default |
Purpose / control |
|
email_alerts |
boolean |
ON |
Receive email alerts. Confirm the contact email is verified and monitored. |
|
sms_alerts |
boolean |
OFF |
Receive SMS alerts. Confirm phone number, consent, availability and cost. |
|
push_notifications |
boolean |
ON |
Receive app or browser push notifications on supported devices. |
|
quiet_hours_start |
time |
22:00 |
Beginning of the period in which non-urgent notifications should not interrupt the user. |
|
quiet_hours_end |
time |
07:00 |
End of quiet hours. Confirm behaviour across overnight periods and timezone. |
|
maintenance_updates |
boolean |
ON |
Receive maintenance request and status updates. |
|
payment_received |
boolean |
ON |
Receive notifications when a payment is recorded as received. |
Procedure
1. Select the channels the company is authorised and operationally able to receive.
2. Set quiet hours using the company timezone configured under Localization.
3. Keep payment notifications enabled for the responsible finance or operations user unless another verified process exists.
4. Keep maintenance updates enabled for staff responsible for service delivery and escalation.
5. Save the section and trigger a controlled test notification where the interface supports it.
6. Confirm delivery on email, SMS and push separately; one successful channel does not prove the others work.
7. Review quiet-hour behaviour with an event created inside and outside the defined period.
Notification Centres
|
Controller / action |
Purpose |
|
Landlord\Shared\NotificationController@index |
View notifications for the authenticated landlord using Notification records filtered by Auth::user(). |
|
@send |
Open the compose/send process for a notification to clients. |
|
@store |
Save and dispatch a notification. |
|
API\Mobile\Tenant\NotificationController@index |
Client views mobile notifications. |
|
@markRead |
Mark a client notification as read. |
|
SuperAdmin\Core\NotificationController@index |
Platform-wide notification management. |
|
SuperAdmin Settings @notifications / @landlordNotifications |
System notification configuration and defaults for landlords. |
|
Quiet hours do not replace escalation design |
|
|
STEP |
Configure Appearance |
Expected result: The interface opens with the preferred theme, density, sidebar state and page size.
Open Settings -> Appearance. SettingsController@appearance loads the landlord_appearance group. Appearance settings improve usability and do not change the underlying business records.
|
Key |
Type |
Default |
Options / effect |
|
theme |
select |
system |
light, dark or system. System follows the device or browser preference where supported. |
|
compact_mode |
boolean |
OFF |
Uses a denser list presentation so more rows fit on screen. |
|
sidebar_collapsed |
boolean |
OFF |
Starts the application with the sidebar collapsed. |
|
items_per_page |
select |
10 |
Default list size: 10, 25, 50 or 100 items. |
1. Choose the preferred theme and check dashboard, form, table and modal readability.
2. Enable compact mode only where staff can still read statuses, action menus and financial values clearly.
3. Choose whether the sidebar should begin collapsed for smaller screens or focused workflows.
4. Set items per page based on the device and typical workload. Larger values may increase scrolling and load time.
5. Save and refresh the browser to confirm the appearance persists.
|
Per-user experience |
|
|
STEP |
Configure Communication Defaults |
Expected result: Outgoing routine communications use the approved signature, auto-reply and read-receipt behaviour.
Open Settings -> Communication. SettingsController@communication loads the landlord_communication group. These options define reusable communication defaults rather than the content of every event-specific notification.
|
Key |
Type |
Default |
Purpose / control |
|
email_signature |
textarea |
Empty |
Signature appended to outgoing emails. Include approved company identity and contact information. |
|
auto_reply |
boolean |
OFF |
Enables an automatic response to new inbound messages. |
|
auto_reply_message |
textarea |
“Thank you...” |
Content sent when auto-reply is enabled. Include response expectations without making unsupported promises. |
|
send_read_receipts |
boolean |
ON |
Sends or records read receipts where the communication channel supports them. |
Procedure
1. Prepare an approved email signature that matches the General company settings.
2. Decide whether the company can monitor and respond to inbound messages quickly enough to use an auto-reply.
3. Write an auto-reply message that acknowledges receipt, states normal response expectations and gives an urgent-contact route where approved.
4. Choose read-receipt behaviour according to privacy and communication policy.
5. Save the section and send a test message to an internal recipient.
6. Verify the signature formatting, auto-reply content, sender identity and read-receipt behaviour.
|
Read receipt limitations |
Steps 6 to 8: configure defaults that influence new operational records and financial workflows.
|
STEP |
Configure Property Management Defaults |
Expected result: New property and lease workflows begin with approved default values that staff review before saving live records.
Open Settings -> Property. SettingsController@property loads landlord_property. The controller can pull default_lease_term from User.default_lease_duration and default_security_deposit from User.default_security_deposit before applying the defined defaults.
|
Key |
Type |
Default |
Operational meaning / control |
|
default_lease_term |
number |
12 |
Default lease duration in months. Staff must still verify every lease term. |
|
maintenance_threshold |
number |
500 |
Auto-approval threshold for maintenance in the configured monetary context. Confirm currency and authorisation rules. |
|
inspection_frequency |
select |
6 months |
Routine interval: 3, 6 or 12 months. |
|
allow_pets_default |
boolean |
OFF |
Default pet policy for new listings or records. |
|
smoking_allowed |
boolean |
OFF |
Default smoking policy. |
|
require_renters_insurance |
boolean |
ON |
Require renter’s insurance by default. |
|
default_security_deposit |
number |
0 |
Default deposit amount. Confirm currency, law and lease terms. |
Procedure
1. Confirm the company’s standard lease duration and whether the default is appropriate across residential and commercial portfolios.
2. Enter the maintenance auto-approval threshold and document which roles may approve work above it.
3. Select the inspection interval and align it with notice requirements and property-management policy.
4. Set pet and smoking defaults. Treat these as starting values, not substitutes for property-specific restrictions.
5. Enable renter’s insurance where required by company policy and permitted by applicable law.
6. Enter the default security deposit and verify how the system determines the currency.
7. Save and create a controlled test property or lease to confirm that the expected defaults are pre-populated.
8. Ensure staff are trained to review and override defaults only through approved procedures.
|
A default is not a final contract term |
|
|
Maintenance threshold currency requires confirmation |
|
|
STEP |
Configure Client Management Defaults |
Expected result: Screening, renewal, welcome, guarantor, co-signer, document-expiry and renewal defaults align with company policy.
Open Settings -> Tenant or Client settings. SettingsController@tenant loads landlord_tenant. User-facing documentation uses Client, while the backend method and setting group retain tenant terminology. The auto-renewal reminder can begin with User.lease_renewal_notice_period.
|
Key |
Type |
Default |
Purpose / control |
|
screening_required |
boolean |
ON |
Require screening for all new clients. Confirm consent and applicable-law requirements. |
|
auto_renewal_reminder |
number |
60 |
Days before lease end to send the renewal reminder. |
|
welcome_email_enabled |
boolean |
ON |
Send an automated welcome email to a new client. |
|
require_guarantor |
boolean |
OFF |
Require a guarantor for applicants with low credit according to the configured policy. |
|
allow_cosigners |
boolean |
ON |
Allow co-signers on leases. |
|
document_expiry_reminder |
number |
30 |
Days before a client or lease document expires to alert the landlord. |
|
auto_renew_leases |
boolean |
OFF |
Automatically renew leases on expiry where the workflow supports it. |
Procedure
1. Confirm the company screening policy and enable screening only with the required client consent and lawful criteria.
2. Set the renewal reminder early enough for review, pricing, notices and signatures.
3. Review the welcome email template before enabling automated delivery.
4. Define the conditions under which a guarantor may be required and ensure human review remains part of the decision.
5. Decide whether co-signers are supported by the company’s lease process and templates.
6. Set the document-expiry reminder to allow sufficient time for replacement and verification.
7. Keep automatic lease renewal off unless the legal, contract, notification and pricing workflow has been fully approved and tested.
8. Save and test the settings using a non-production client and lease.
|
Auto-renewal is a high-risk setting |
|
|
STEP |
Configure Payment Defaults |
Expected result: Transactions, late fees, partial-payment handling and invoice generation begin with approved financial defaults.
Open Settings -> Payment. SettingsController@payment loads landlord_payment. These landlord defaults work alongside platform-wide settings managed through SuperAdmin\Core\PaymentSettingsController.
|
Key |
Type |
Purpose |
Required control |
|
default_currency |
select |
Default currency for transactions. |
Confirm company, property and settlement currency rules. |
|
default_tax_rate |
number |
Default tax percentage. |
Use the approved rate and define whether it applies to rent, fees, services or invoices. |
|
late_fee_method |
select |
flat or percentage. |
Must align with the lease and applicable law. |
|
late_fee_amount |
number |
Flat amount or percentage value according to the method. |
Validate interpretation and maximums. |
|
grace_period_days |
number |
Days before a late fee applies. |
Align with lease terms and reminders. |
|
accept_partial_payments |
boolean |
Allow clients to pay less than the full due amount. |
Define allocation, balance, receipt and arrears treatment. |
|
auto_generate_invoices |
boolean |
Generate invoices automatically on due dates. |
Confirm schedule, tax, numbering and delivery. |
Procedure
1. Select the default transaction currency and confirm how property-specific or country-specific currencies override it.
2. Enter the approved tax rate and document the transactions to which it applies.
3. Choose flat or percentage late fees, then enter the corresponding amount.
4. Set the grace period and verify that the lease template and reminder schedule use the same rule.
5. Decide whether partial payments are accepted and define how the remaining balance will be treated.
6. Enable automatic invoices only after invoice timing, numbering, tax and recipient data are tested.
7. Save and create a test invoice or payment obligation.
8. Verify amounts, currency, tax, late-fee timing, partial-payment handling and notifications before go-live.
Related SuperAdmin Payment Functions
|
Action |
Purpose |
|
PaymentSettingsController@edit |
Open platform-wide payment settings. |
|
@landlordEdit |
Open landlord-specific payment configuration. |
|
@update |
Save payment settings. |
|
WalletSettingsController@index / @update |
Manage platform wallet configuration. |
|
@rates / @updateMarkupSettings |
Manage exchange rates and FX markup. |
|
MofiSettingsController |
Manage Mofi payment service configuration. |
Steps 9 to 12: define management outputs, external connections, regional behaviour and data-protection preferences.
|
STEP |
Configure Reporting Preferences |
Expected result: Reports use the preferred format, fiscal year and scheduled distribution settings.
Open Settings -> Reporting. SettingsController@reporting loads landlord_reporting. These settings define the default report output and automated email schedule where the reporting service supports it.
|
Key |
Type |
Purpose |
Control |
|
default_report_format |
select |
PDF, CSV or Excel. |
Choose based on presentation, analysis and import requirements. |
|
fiscal_year_start |
select |
Month in which the fiscal year begins. |
Align with company accounting policy. |
|
email_reports_enabled |
boolean |
Enable scheduled email reports. |
Use only approved recipients and data classifications. |
|
report_frequency |
select |
daily, weekly or monthly. |
Choose a useful cadence without generating unnecessary sensitive copies. |
|
report_recipients |
text |
Comma-separated email addresses. |
Validate every recipient and remove former staff promptly. |
1. Select the file format best suited to the company’s normal use.
2. Set the fiscal-year start and verify date-range calculations in a sample report.
3. Enable scheduled reports only after the recipient list is approved.
4. Choose daily, weekly or monthly delivery.
5. Enter recipients as comma-separated email addresses and check for typing errors.
6. Save and run or wait for a controlled test report.
7. Confirm the subject, attachment format, data range, company filter and recipient list.
|
Email creates additional copies |
|
|
STEP |
Configure External Integrations |
Expected result: Approved integrations are enabled, endpoints are verified and test events are observed without disrupting live operations.
Open Settings -> Integration. SettingsController@integration loads landlord_integration. The section provides landlord-facing switches and URLs, while dedicated controllers handle inbound and outbound webhook traffic and SuperAdmin tools test platform services.
|
Key |
Type |
Purpose / control |
|
api_enabled |
boolean |
Enable REST API access. Confirm authentication, scope, rate limits and authorised consumers in the live implementation. |
|
webhook_url |
url |
Primary outbound event endpoint. Use HTTPS and a controlled receiver. |
|
slack_webhook_url |
url |
Slack Incoming Webhook for alerts. Treat the URL as a secret. |
|
google_calendar_sync |
boolean |
Synchronise maintenance schedules and inspections with Google Calendar. |
|
quickbooks_integration |
boolean |
Enable QuickBooks accounting integration. |
|
zapier_enabled |
boolean |
Enable Zapier workflow automation. |
Figure 3. Integration and webhook ecosystem
Safe Integration Procedure
1. Assign an internal owner for the integration and document the business purpose.
2. Confirm the external service account, credentials, permissions and test environment.
3. Enter the endpoint or enable the integration only in the authorised Leaseora account.
4. Configure webhook signing or authenticity verification where supported.
5. Use testWebhook or the service-specific test function before sending live data.
6. Verify a successful response, resulting Leaseora action, duplicate protection and error handling.
7. Check logs and the SuperAdmin Webhook Monitor where available.
8. Document support contacts and a disable/rollback process.
9. Move to live use only after business and technical sign-off.
Inbound and Outbound Controllers
|
Integration area |
Controller / purpose |
|
CRM leads |
CrmWebhookInboundController@handle receives leads; @verify checks authenticity. |
|
Outbound endpoints |
WebhookApiController@index, @store, @destroy and @testWebhook manage landlord webhook endpoints. |
|
KYC |
KycWebhookController and VeriffWebhookController handle identity-verification callbacks. |
|
Flutterwave |
FlutterwaveTransferWebhookController and FlutterwaveVASWebhookController handle transfer and VAS events. |
|
Squad |
SquadWebhookController handles payment events. |
|
Solaris |
SolarisWebhookController handles banking events. |
|
Embedly |
EmbedlyWebhookController handles wallet and virtual-account callbacks. |
|
Mofi |
MofiWebhookController handles Mofi payment events. |
|
DocuSign |
DocuSignWebhookController handles electronic-signature events. |
|
PayPal |
PayPalWebhookController handles PayPal events. |
|
Monitoring |
SuperAdmin\Core\WebhookMonitorController monitors platform webhooks. |
AI Integration and Testing
|
Controller / action |
Purpose |
|
SuperAdmin\Core\AIIntegrationController |
Manage AI service integrations such as OpenAI. |
|
SettingsController@checkAiService |
Verify AI service connectivity. |
|
@testAiChat |
Test AI chat functionality. |
|
@testAiConnection / @testOpenai |
Test the OpenAI connection. |
|
@checkAiConfig |
Validate AI configuration. |
|
@getAiErrorLogs |
Review AI service error logs. |
|
Webhook URLs and secrets are sensitive |
|
|
The toggle is not the whole integration |
|
|
STEP |
Configure Localization |
Expected result: Dates, times and interface preferences are interpreted consistently for the company’s region.
Open Settings -> Localization. SettingsController@localization loads landlord_localization. Localization affects how users interpret deadlines, quiet hours, reminders, reports and other time-based information.
|
Key |
Type |
Purpose / examples |
|
timezone |
select |
System timezone, for example Europe/London or Africa/Lagos. |
|
date_format |
select |
DD/MM/YYYY, MM/DD/YYYY or YYYY-MM-DD. |
|
time_format |
select |
12-hour or 24-hour display. |
|
language |
select |
Interface language. |
|
country |
text |
Country or region. |
1. Select the timezone where the company’s operational deadlines should be interpreted.
2. Choose an unambiguous date format for the main user group.
3. Select 12-hour or 24-hour time display.
4. Choose the supported interface language.
5. Enter the company country or region.
6. Save and verify a quiet-hour time, lease date, inspection schedule and report date.
7. For multi-country operations, document whether settings are user-, company- or property-specific in the live build.
|
Timezone comes before schedules |
|
|
STEP |
Configure Backup and Data Preferences |
Expected result: Automatic backup preferences, retention, file inclusion and encryption are approved and recorded.
Open Settings -> Backup. SettingsController@backup loads landlord_backup. The settings describe the requested backup behaviour. The supplied scenario does not identify the underlying backup engine, storage destination or restoration service, so those must be confirmed operationally.
|
Key |
Type |
Default |
Purpose / control |
|
auto_backup_enabled |
boolean |
ON |
Enable automatic backups. |
|
backup_frequency |
select |
Not supplied |
daily, weekly or monthly. |
|
retention_days |
number |
30 |
Number of days backup files are retained. |
|
include_files |
boolean |
ON |
Include uploaded files in addition to database/configuration data where supported. |
|
encrypted_backups |
boolean |
ON |
Encrypt backup files. |
Procedure
1. Confirm the organisation’s recovery objectives and regulatory retention requirements.
2. Enable automatic backups and choose daily, weekly or monthly frequency.
3. Set the retention period to 30 days or another approved value supported by policy.
4. Enable file inclusion when uploaded documents and media must be recoverable.
5. Keep encryption enabled and confirm how keys are managed.
6. Save the settings and confirm the backup service receives the configuration.
7. Verify that a backup is created, retained and accessible only to authorised personnel.
8. Perform a controlled restoration test and document the result.
Steps 13 and 14: tailor Leaseora to the real estate company’s operating model without exposing unnecessary modules or capabilities.
|
STEP |
Enable or Disable Platform Modules |
Expected result: The company navigation contains only the modules that are approved and required for its operations.
Open Settings -> Modules. SettingsController@modules displays the available module states and updateModules($request) saves changes. Module state is persisted in the Setting model under a modules group. When a module is disabled, it is hidden from the sidebar for the landlord and their staff according to the supplied design.
Typical Module Toggles
|
Module |
Business use |
Before disabling |
|
Properties |
Property and unit records. |
Confirm no staff depend on the module for active records. |
|
Leases |
Lease creation and lifecycle. |
Confirm active lease operations and client access. |
|
Maintenance |
Requests, work orders and updates. |
Confirm open maintenance cases and notifications. |
|
CRM |
Leads, pipeline and sales follow-up. |
Confirm inbound webhooks and active lead workflows. |
|
WeBuild |
We Build For You project and contract operations. |
Confirm projects, contracts and payments. |
|
Property Development |
Development projects, phases, tasks and documents. |
Confirm active projects and team access. |
|
Land Management |
Land records, sales and management. |
Confirm active parcels and transactions. |
|
Property Sales |
Property sale transactions. |
Confirm active offers, buyers and documents. |
|
Mortgage |
Mortgage applications and servicing. |
Confirm active applications and lender workflows. |
|
Insurance |
Insurance records and workflows. |
Confirm active policies and expiry reminders. |
|
Utilities |
Utility records, billing and client access. |
Confirm current utility charges and integrations. |
|
Virtual Tours |
360-degree or virtual-tour features. |
Confirm public listings and media dependencies. |
|
Vendors |
Vendor and contractor management. |
Confirm maintenance and procurement dependencies. |
|
Marketing Automation |
Campaigns, sequences and automation. |
Confirm active campaigns, recipients and CRM links. |
Safe Module-Change Procedure
1. Review the company subscription, entitlement and approved operating model.
2. Identify all records, users, integrations, reports and client functions that depend on the module.
3. Notify the affected department and select a low-risk change window.
4. Export or document critical records where the business requires an additional reference.
5. Disable or enable one module at a time through updateModules.
6. Refresh the landlord and staff navigation and verify the expected visibility.
7. Confirm that disabling navigation does not remove or corrupt existing records.
8. Test related permissions, reports, notifications and client access.
9. Record the change, approver, date, reason and validation result.
|
Hidden is not deleted |
|
|
Dependencies require testing |
|
|
STEP |
Enable or Disable Specific Features |
Expected result: Only approved capabilities are available inside enabled modules.
Open Settings -> Features. SettingsController@features displays granular feature toggles and updateFeatures($request) saves the selected states. Feature controls allow a company to retain a module while limiting optional or advanced capabilities.
|
Feature area |
Examples supplied |
Control consideration |
|
AI |
AI lease generation, risk assessment and recommendations. |
Use human review, approved prompts and access controls. |
|
Blockchain |
Document verification. |
Use for final eligible records and verify transaction evidence. |
|
IoT |
Device integration. |
Confirm device security, permissions and alert ownership. |
|
Virtual staging |
AI or digital property presentation. |
Confirm marketing approval and disclosure. |
|
Lease Angel |
Rent financing. |
Enable only for approved programmes, eligibility and funding. |
|
SEPA direct debit |
European payment collection. |
Require valid mandates and regional payment compliance. |
|
Split lease |
Co-tenant or split-lease workflow. |
Confirm templates, liability and legal approval. |
|
Bulk operations |
Mass update, archive, export or other actions. |
Restrict to authorised users and test selection controls. |
|
Export features |
Download or export records. |
Apply data classification and permission controls. |
1. Confirm that the parent module is enabled.
2. Check the company plan, business approval and legal/security requirements.
3. Enable one feature and verify the relevant navigation or action appears only to authorised roles.
4. Test the feature with controlled records.
5. Confirm that disabling it removes the action without damaging existing records.
6. Document the approved state in the company configuration register.
Step 15: apply the baseline account-protection rules before using advanced monitoring and wallet controls.
|
STEP |
Configure Security Preferences |
Expected result: Baseline 2FA, session, login-alert, password, IP and activity-log settings reflect the company security policy.
Open Settings -> Security. SettingsController@security loads landlord_security. These settings provide the first layer of protection and connect to the advanced Security Management and Security Dashboard functions described in later steps.
|
Key |
Type |
Default |
Meaning / control |
|
two_factor_auth |
boolean |
OFF |
Enable two-factor authentication. Complete setup and verify codes before relying on the toggle. |
|
session_timeout |
number |
120 |
Session timeout in minutes. Balance security with operational use. |
|
login_notifications |
boolean |
ON |
Notify the user about new logins. |
|
password_expiry |
number |
90 |
Password expiry interval in days. |
|
ip_whitelist |
textarea |
Empty |
Comma-separated allowed IP addresses. |
|
activity_logging |
boolean |
ON |
Enable detailed account activity logging. |
Figure 4. Three-layer account and transaction security
Baseline Security Procedure
1. Confirm recovery contacts and access to the registered email and phone before enabling stronger controls.
2. Enable 2FA and complete the QR-code and verification process in Security Management.
3. Store backup codes securely and separately from the main device.
4. Set the session timeout according to role risk and device usage.
5. Keep login notifications enabled and train staff to report unknown logins.
6. Set the password-expiry interval according to company policy.
7. Add IP addresses only after confirming whether staff use static addresses, offices, VPNs or remote networks.
8. Keep activity logging enabled for audit and investigation.
9. Save and test login, timeout, alert and access behaviour using an authorised test account.
|
Do not enable an IP whitelist casually |
|
The 2FA toggle must be paired with setup |
Steps 16 to 18: configure multi-factor authentication, access restrictions, fraud controls, live monitoring, audits and wallet-specific risk management.
|
STEP |
Use the Security Management Dashboard |
Expected result: 2FA, IP, fraud, anomaly and security-event controls are configured and documented.
Landlord\Shared\SecurityManagementController provides advanced controls beyond the basic Settings page. Its constructor receives the security services required by the implementation. Use the dashboard for deliberate security administration rather than routine profile changes.
Two-Factor Authentication
|
Action |
Purpose |
Control |
|
twoFactorAuth |
View current 2FA status and configuration. |
Confirm the correct account before changes. |
|
enableTwoFactor |
Enable 2FA and return a QR code and backup codes. |
Verify password/session and enroll the intended authenticator device. |
|
verifyTwoFactor |
Verify the time-based code. |
Complete verification before declaring 2FA active. |
|
generateQR |
Regenerate the QR code. |
Use when approved and treat the secret as sensitive. |
|
generateBackupCodes |
Create replacement one-time codes. |
Previous codes become invalid; store the new set securely. |
|
disableTwoFactor |
Disable 2FA after verification. |
Require a documented reason and account-owner approval. |
Recommended 2FA Enrollment Procedure
1. Open Two-Factor Authentication from the Security Management dashboard.
2. Select Enable Two-Factor Authentication.
3. Scan the generated QR code with the approved authenticator application.
4. Enter the current six-digit TOTP code to verify enrollment.
5. Download or record the backup codes and store them in the company-approved secure location.
6. Sign out and complete a test login using the authenticator.
7. Test one backup code through the approved recovery process if the implementation permits a controlled test.
8. Record the enrollment date and support path without storing the QR secret in the change record.
IP Whitelist
|
Action |
Purpose |
|
ipWhitelist |
View allowed IP addresses. |
|
addIPToWhitelist |
Add an allowed IP address. |
|
removeIPFromWhitelist |
Revoke an address by whitelist record ID. |
1. Collect the approved public IP addresses from IT.
2. Confirm whether they are static and whether a corporate VPN is required.
3. Add one address and test access from the allowed network.
4. Test the documented emergency access process before expanding enforcement.
5. Remove obsolete addresses immediately after an office, provider or VPN change.
Fraud and Anomaly Detection
|
Action |
Purpose |
Expected follow-up |
|
fraudDetection |
Open active fraud-alert dashboard. |
Prioritise unresolved high-risk alerts. |
|
analyzeTransaction |
Submit transaction information for fraud analysis. |
Review evidence and avoid automatic accusation. |
|
resolveFraudAlert |
Mark a specific alert resolved. |
Record the reason, evidence and action. |
|
anomalyDetection |
Open anomaly-pattern dashboard. |
Review unusual activity in context. |
|
scanForAnomalies |
Run an account-activity scan. |
Investigate results and false positives. |
|
securityEvents |
View chronological security events. |
Correlate logins, password, 2FA and access changes. |
|
statistics |
View security KPIs. |
Track trends, not only isolated counts. |
|
settings / updateSettings |
View and save advanced security configuration. |
Use approval and validation. |
|
Detection output requires investigation |
|
|
STEP |
Monitor Sessions, Access and Audits |
Expected result: The company can identify active sessions, unusual access and accountable changes, and can revoke compromised sessions.
Landlord\Shared\SecurityController provides a dedicated overview of account security and session activity. It complements the setting values by showing operational evidence of how the account is being used.
|
Action |
Dashboard content / result |
|
dashboard |
Active sessions, recent logins, flagged activity, security health score and recent security events. |
|
monitoring |
Live session activity, IP-address monitoring and login-frequency patterns. |
|
accessControl |
Staff members, access levels, permission assignments and unusual access patterns. |
|
audits |
Login, logout, password and permission events with IP, device and timestamp; export where supported. |
|
revokeSession |
Force-logout a selected active session by revoking its session token. |
Lost or Compromised Device Procedure
1. Open Security Dashboard from a trusted device.
2. Review active sessions and identify the device, IP or time associated with the concern.
3. Use revokeSession to terminate the selected session.
4. Change the password and regenerate 2FA backup codes when compromise is possible.
5. Review accessControl and audits for unauthorised changes.
6. Check wallet security and transaction activity.
7. Remove the device through MobileProfileSettingsController@removeDevice where it remains listed.
8. Record the incident, actions and follow-up monitoring.
|
Session revocation is immediate incident containment |
|
|
STEP |
Manage Wallet Security |
Expected result: Wallet transactions are monitored through dedicated fraud, risk, limit, IP, audit and 2FA controls.
Landlord\Shared\WalletSecurityController applies security oversight to wallet activity. Wallet\TransactionSecurityController provides transaction-level controls. These functions are separate from the ordinary Payment settings because wallet risk requires transaction evidence and investigation.
|
Action |
Purpose |
|
index |
Wallet security overview. |
|
fraudAlerts |
View wallet transaction fraud alerts. |
|
fraudPatterns |
View detected patterns affecting wallet activity. |
|
investigate |
Open an investigation on a specific alert. |
|
riskDashboard |
View wallet risk scores and summaries. |
|
validateTransactionLimit |
Check a transaction against configured limits before processing. |
|
logTransactionIp |
Record the transaction IP for the security audit. |
|
auditLogs |
View wallet-specific audit history. |
|
twoFactorStatus |
Check whether required wallet 2FA is active. |
|
recommendations |
View security recommendations for the wallet. |
Wallet Investigation Procedure
1. Open Fraud Alerts and select the specific alert.
2. Review transaction amount, currency, account, time, IP, device and prior pattern.
3. Check transaction limits and 2FA status.
4. Open an investigation and record the assigned reviewer.
5. Compare wallet records with payment, bank, gateway and user activity evidence.
6. Contain risk through approved controls without deleting evidence.
7. Resolve or escalate the alert with a documented reason.
8. Review recommendations and adjust limits or security policy through the authorised process.
|
Do not resolve alerts without evidence |
Step 19: persist settings safely, confirm the effective value and retain an accountable change process.
|
STEP |
Save Settings and Validate the Result |
Expected result: Submitted settings are validated, stored per key and group, cache is invalidated, and the operational result is confirmed.
SettingsController@update($request) handles the common save flow. For each submitted key, the controller validates the form value and uses Setting::updateOrCreate with the key, group and authenticated user ID. Existing records are updated; missing records are created. The relevant settings-group cache is invalidated and a success notification is returned.
Persistence Pattern
|
Conceptual update |
Standard Save Procedure
1. Review every changed field before selecting Save.
2. Confirm that the correct setting group is being submitted.
3. Submit the form and check validation messages.
4. Confirm the success notification.
5. Reopen or refresh the section and verify the saved value remains.
6. Check the operational effect in the relevant workflow, not only the form.
7. Confirm that another landlord or unauthorised staff user did not receive the change.
8. Record high-impact changes in the company change log.
Special Update Handlers
|
Action |
Purpose |
Validation |
|
update |
Save normal section settings as grouped key-value records. |
Field types, allowed values and user scope. |
|
updateModules |
Save complete module enable/disable states. |
Entitlement, dependencies, role visibility and record access. |
|
updateFeatures |
Save granular feature states. |
Parent module, entitlement, permissions and integration readiness. |
Recommended Change Record
|
Field |
What to record |
|
Change ID |
Unique internal reference. |
|
Setting group and key |
Exact section and option changed. |
|
Previous and new value |
Values before and after the change. |
|
Reason |
Business, legal, security or operational purpose. |
|
Requested by / approved by |
Accountable people. |
|
Test evidence |
Screenshots, test result or audit reference without exposing secrets. |
|
Implementation date |
Date and time with timezone. |
|
Rollback plan |
How the prior state will be restored. |
|
Validation owner |
Person who confirmed the operational result. |
|
Save one section at a time |
Step 20: understand the platform layer that establishes defaults, service configuration and health checks above landlord-level settings.
|
STEP |
Configure Platform Settings |
Expected result: Platform defaults and external service configurations are managed without replacing landlord-specific business choices.
SuperAdmin\Core\SettingsController manages configuration that can affect all landlords. Landlord users should understand that some controls, options or services depend on this platform layer even when their own setting is enabled.
|
Action / area |
Purpose |
|
index |
View all platform settings. |
|
specialized($group) |
Open a specific settings group. |
|
getAllSettingsGroups |
Return all group names. |
|
update |
Update platform setting values. |
|
getSettings |
Return settings data as JSON. |
|
landlordNotifications |
Configure notification defaults for new landlords. |
|
landlordGeneral |
Configure general defaults for new landlords. |
|
notifications |
System-wide notification configuration. |
|
payment |
Platform payment settings such as fee structures and gateway defaults. |
|
adCharges |
Advertising charge configuration. |
|
show($setting) |
View a specific Setting record. |
Email, KYC and AI Testing
|
Function |
Purpose |
|
testEmail / emailTesting / testEmailService |
Test platform email delivery and individual email services. |
|
kycTesting / testVeriffConnection / createTestVeriffSession |
Test Veriff identity-verification connectivity and session creation. |
|
aiChatTesting / checkAiService / testAiChat |
Test AI chat and service health. |
|
testAiConnection / testOpenai / checkAiConfig |
Test and validate OpenAI configuration. |
|
getAiErrorLogs / testAiChatService |
Review AI errors and test a specific AI chat service. |
Specialised SuperAdmin Controllers
|
Controller |
Responsibility |
|
PaymentSettingsController |
Platform and landlord-specific payment configuration. |
|
WalletSettingsController |
Wallet configuration, exchange rates and FX markup. |
|
MofiSettingsController |
Mofi payment service configuration. |
|
AuthPageSettingsController |
Login and registration page appearance. |
|
SecurityComplianceController |
Platform security and compliance configuration. |
|
AIIntegrationController |
AI service management and testing. |
|
NotificationController |
Platform-wide notification management. |
|
WebhookMonitorController |
Platform-wide webhook monitoring. |
|
Platform and landlord layers must not conflict silently |
Platform Change Procedure
1. Identify the platform setting, affected landlords, service and business reason.
2. Review backward compatibility, data migration, security, payment and notification impact.
3. Test the change in a non-production environment using representative landlord accounts.
4. Prepare support guidance, monitoring and rollback before implementation.
5. Apply the change during an approved window and verify service health.
6. Confirm that landlord-specific values and permissions continue to work.
7. Communicate material changes and retain platform audit evidence.
|
Service health check |
Evidence |
|
Email |
Test message and service status. |
|
KYC / Veriff |
Connection test and test-session result. |
|
AI |
Provider connection, chat test and error-log review. |
|
Payments / wallet |
Configured service status and controlled transaction test. |
|
Webhooks |
Monitor result, response status and downstream record. |
Step 21: provide private and corporate clients with role-appropriate control of profile, privacy, notifications, billing, devices and IoT preferences.
|
STEP |
Use Client Account Settings |
Expected result: The client can maintain account information and preferences without receiving landlord-only configuration access.
Clients access profile and settings through /tenant/settings, /tenant/profile or the supported mobile APIs. User-facing explanations use Client while backend namespaces retain Tenant. Separate controllers support private clients, corporate clients and corporate company profiles.
Client Profile Management
|
Controller |
Responsibility |
|
Users\Tenant\Share\TenantProfileController |
View and edit the shared client profile, upload photo and update password. |
|
PrivateTenantProfileController@show / @store |
Private client profile management. |
|
CorporateTenantProfileController@show / @store |
Corporate client profile management. |
|
CompanyProfileController |
Corporate client company profile. |
Notification, Billing and IoT
|
Area |
Controller / settings |
|
Notifications |
Users\Tenant\Share\NotificationController / NotificationsController: email, SMS, push and notification-frequency preferences. |
|
Billing |
Users\Tenant\Share\BillingController for client billing information. |
|
Corporate billing |
Users\Tenant\Corporate\CorporateBillingController and API\Mobile\Tenant\CorporateBillingController. |
|
IoT |
TenantIoTPreferencesController for device preferences and alerts. |
Mobile Profile Settings
|
Action |
Client capability |
|
getProfile |
Retrieve the full profile. |
|
updatePersonalInfo |
Update personal information. |
|
uploadPhoto / deletePhoto |
Add or remove a profile photo. |
|
changePassword |
Change the account password. |
|
updatePhone / updateEmail |
Update contact channels. |
|
getPrivacySettings / updatePrivacySettings |
View or change privacy preferences. |
|
getActivityLog |
View account activity. |
|
getConnectedDevices |
View devices currently connected. |
|
removeDevice |
Disconnect a selected device. |
|
deleteAccount |
Initiate GDPR account deletion. |
Client Security Procedure
1. Keep profile email and phone current so recovery and alerts reach the correct person.
2. Use a strong password and complete 2FA where the client experience supports it.
3. Review connected devices periodically.
4. Remove any unknown or lost device.
5. Review privacy and notification preferences.
6. Contact the landlord or Leaseora support for unauthorised activity without sharing passwords or verification codes.
7. Use account deletion only after understanding its effect on legal, billing, lease and retention records.
|
Account deletion is a controlled process |
Client Settings Support Matrix
|
Client issue |
First review |
Escalate when |
|
Profile information is wrong |
Confirm user type, profile controller and saved value. |
The correct account cannot update or data reverts. |
|
Email or phone change fails |
Check verification, validation and existing account conflicts. |
Recovery or security alerts are affected. |
|
Notification preference ignored |
Check toggle, quiet hours, channel configuration and device permission. |
Platform delivery or event routing fails. |
|
Unknown device |
Remove the device, revoke session and review activity. |
There is unauthorised activity or wallet risk. |
|
Billing information issue |
Confirm private/corporate billing controller and company context. |
Invoice, subscription or payment records are wrong. |
|
Deletion request |
Confirm identity and request status without promising immediate erasure. |
Legal retention, active lease, billing or privacy review is required. |
Step 22: configure company entities and user access for corporate real estate organisations.
|
STEP |
Manage Corporate Company Settings and Users |
Expected result: Each company entity has accurate information, an accountable dashboard and only the users who require access.
Corporate landlords can manage multiple company entities through CompanyController. This allows a group to separate legal entities, operating companies or business units while using one Leaseora environment according to the supported implementation.
|
Function |
Corporate use |
Control |
|
create / store |
Create a company entity. |
Use approved legal and contact data. |
|
dashboard($id) |
Open the entity dashboard. |
Confirm company context before actions. |
|
manageUsers($id) |
View entity users. |
Review role and access regularly. |
|
addUser($request, $id) |
Grant a user access. |
Verify identity, role, manager and start date. |
|
removeUser($companyId, $userId) |
Revoke access. |
Remove promptly when assignment ends. |
|
summary |
View company portfolio summary. |
Confirm filters and entity consolidation. |
Corporate User-Onboarding Procedure
1. Create or verify the company entity.
2. Define the user’s job role, company entity, property scope and required modules.
3. Add the user through manageUsers / addUser.
4. Apply the minimum permissions required.
5. Require password setup and 2FA according to policy.
6. Test navigation, company context and restricted actions.
7. Record the approval and access owner.
8. Review access after role changes and remove it immediately when no longer required.
Corporate Billing References
|
Controller |
Purpose |
|
Users\Tenant\Corporate\CorporateBillingController |
Subscription and billing management for corporate clients. |
|
API\Mobile\Tenant\CorporateBillingController |
Mobile corporate billing management. |
|
Company membership is not the same as permission |
Effective-Value Lifecycle
|
Stage |
System behaviour |
Operational meaning |
|
Definition |
The controller defines keys, types and defaults for a group. |
The section can render even on a new account. |
|
Profile source |
Selected values begin with Company or User fields. |
Existing account data can pre-populate the form. |
|
Read |
getSettingsWithDefaults fetches saved records and merges them with definitions. |
Users see an effective value for every key. |
|
Edit |
An authorised user changes one or more fields. |
The proposed value has not yet changed system behaviour. |
|
Validate |
The request is checked against field rules and allowed values. |
Invalid data should be rejected before persistence. |
|
Persist |
updateOrCreate creates or updates the key/group/user record. |
The landlord-specific value becomes stored. |
|
Invalidate cache |
The group cache is cleared. |
Subsequent reads should not return the previous cached value. |
|
Use |
Related workflows read the effective setting. |
Operational behaviour changes where the integration is implemented. |
|
Review / change |
Staff validate results and may update the value again. |
The company maintains an accountable configuration lifecycle. |
Setting Dependency Examples
|
Primary setting |
Related dependency |
Risk if not aligned |
|
quiet_hours_start / end |
timezone and notification-event priority. |
Alerts may arrive at unexpected local times. |
|
auto_renewal_reminder |
lease expiry date, notification delivery and renewal workflow. |
Notices may be late or missing. |
|
auto_renew_leases |
lease terms, pricing, notices, signatures and jurisdiction. |
Unapproved legal or financial obligations. |
|
default_currency |
property currency, gateway settlement, wallet and reports. |
Incorrect amounts or inconsistent reporting. |
|
late_fee_method / amount |
lease clause, grace period and invoice process. |
Incorrect charges and disputes. |
|
email_reports_enabled |
report service, recipients, data classification and email delivery. |
Sensitive data sent to wrong recipients. |
|
webhook_url |
event mapping, authentication, receiver availability and retry logic. |
Lost, duplicated or unauthorised events. |
|
google_calendar_sync |
OAuth/authorisation, timezone and event permissions. |
Missing or duplicated schedules. |
|
two_factor_auth |
QR enrollment, TOTP verification and recovery codes. |
False sense of protection or user lockout. |
|
ip_whitelist |
static IPs, VPN, remote work and emergency access. |
Authorised users locked out. |
|
modules |
feature states, permissions, integrations and active records. |
Navigation or workflow disruption. |
|
backup settings |
backup engine, storage, encryption keys and restore process. |
No recoverable backup despite an enabled toggle. |
|
Validate the operational dependency |
Security Layers
|
Layer |
Controller / area |
Purpose |
|
Baseline policy |
SettingsController@security |
Configures 2FA toggle, session timeout, login notifications, password expiry, IP list and activity logging. |
|
Advanced controls |
SecurityManagementController |
Manages TOTP enrollment, backup codes, IP records, fraud/anomaly analysis, events and statistics. |
|
Monitoring and containment |
SecurityController |
Shows active sessions, monitoring, access control, audits and session revocation. |
|
Wallet and transaction risk |
WalletSecurityController and TransactionSecurityController |
Monitors wallet fraud, patterns, limits, IPs, audit logs and transaction 2FA status. |
|
Mobile account security |
MobileProfileSettingsController |
Shows devices, activity, privacy and device removal; supports password/contact changes and deletion request. |
|
Platform security |
SecurityComplianceController and SuperAdmin settings |
Controls platform compliance, service configuration and monitoring. |
Security Incident Response Procedure
1. Confirm the affected account, company, time range and reported symptom.
2. Preserve evidence by reviewing security events, audits, session data, wallet logs and notification history.
3. Contain the incident by revoking suspicious sessions, removing unknown devices and restricting affected access.
4. Change passwords and regenerate 2FA backup codes when credentials may be compromised.
5. Review IP whitelist and remove unauthorised or obsolete entries.
6. Inspect company users, roles, module access and permission changes.
7. Review wallet transactions, fraud alerts, limits and transaction IPs when financial activity is involved.
8. Test recovery on a trusted device and restore only the required access.
9. Document the root cause, impact, evidence, decisions and corrective actions.
10. Continue monitoring and notify affected parties according to the company incident and legal process.
Security Health Measures
|
Measure |
Management question |
|
2FA coverage |
How many privileged users have completed verified 2FA enrollment? |
|
Unknown sessions |
Are there active sessions from unrecognised devices, IPs or locations? |
|
Login failures |
Are failed attempts increasing for an account or IP? |
|
Password and recovery |
Are password-expiry and backup-code processes working? |
|
IP controls |
Are whitelist records current and tested? |
|
Permission changes |
Who granted or removed access and why? |
|
Fraud alerts |
How many wallet or transaction alerts are open, resolved or escalated? |
|
Anomalies |
Are unusual frequency, device, location or transaction patterns increasing? |
|
Audit completeness |
Are login, logout, password, 2FA, permission and sensitive-setting changes recorded? |
|
Incident closure |
Were containment, recovery and prevention actions completed? |
|
Preserve evidence |
Integration Control Matrix
|
Integration |
Setting / controller |
Business purpose |
Key control |
|
REST API |
api_enabled |
External systems use Leaseora APIs. |
Authentication, scopes, rate limits, logs and authorised consumers require confirmation. |
|
Primary outbound webhook |
webhook_url |
Leaseora sends event notifications. |
HTTPS, receiver availability, signature/authentication, retry and idempotency. |
|
Slack |
slack_webhook_url |
Operational alerts to Slack. |
Treat URL as a secret; control channel membership. |
|
Google Calendar |
google_calendar_sync |
Maintenance and inspection scheduling. |
Authorisation, timezone, duplicate events and revocation. |
|
QuickBooks |
quickbooks_integration |
Accounting integration. |
Account mapping, tax, currency, duplicate entries and reconciliation. |
|
Zapier |
zapier_enabled |
Automated workflows. |
Trigger/action mapping, credentials, data exposure and failure alerts. |
|
CRM inbound |
CrmWebhookInboundController |
External portal lead creation. |
Authenticity verification, duplicate leads and mapping. |
|
Veriff / KYC |
KycWebhookController / VeriffWebhookController |
Identity status callbacks. |
Signature verification, subject matching and retry handling. |
|
Payments / banking |
Flutterwave, Squad, Solaris, Embedly, Mofi, PayPal controllers |
Payment, transfer, banking, wallet and account events. |
Gateway signature, transaction reference, idempotency and reconciliation. |
|
DocuSign |
DocuSignWebhookController |
E-signature status. |
Envelope mapping, signer identity and final-document retrieval. |
Webhook Event Validation Checklist
· The request reaches the correct environment and endpoint.
· The sender or signature is verified before processing.
· The event type is supported and mapped to the correct Leaseora action.
· The transaction, application, lead, document or user reference exists and belongs to the correct account.
· Repeated delivery does not duplicate the resulting record or financial action.
· Errors are logged with enough information to investigate without exposing secrets.
· A retry or manual-recovery process exists for temporary failures.
· The platform Webhook Monitor shows the expected result.
· The business team confirms the downstream record or status is correct.
|
Use non-production test events |
|
Role |
Typical settings access |
Control point |
|
Company Administrator |
General, localization, appearance, communication, company users and approved module settings. |
Should not independently approve high-risk financial or security exceptions. |
|
Property Administrator |
Property and selected client defaults. |
Cannot alter platform payment services or security compliance. |
|
Leasing / Compliance |
Screening, guarantor, co-signer, reminders and welcome settings. |
Auto-renewal and legal policy changes require approval. |
|
Finance Officer |
Payment and reporting settings; billing and wallet review. |
Cannot change legal lease terms or resolve fraud without evidence. |
|
Communications / Support |
Notification and communication defaults; client guidance. |
Cannot disable security or send unauthorised bulk communications. |
|
Integration Administrator |
API, webhooks, calendar, accounting and automation. |
Cannot approve its own business mapping or financial reconciliation. |
|
Security Administrator |
2FA, sessions, IP rules, events, audits and containment. |
Privileged actions should be reviewed and logged. |
|
Director / Approver |
Modules, features, high-impact defaults and exceptions. |
Reviews evidence and business impact. |
|
Leaseora SuperAdmin |
Platform defaults, services, testing and monitoring. |
Cannot make landlord-specific legal or financial decisions. |
Minimum Access Practices
· Give users access only to the settings required by their job.
· Require individual accounts and verified 2FA for privileged roles.
· Separate configuration, approval and validation for payment, security, integrations and module changes.
· Restrict access to secrets, webhooks, tax IDs, reports, audit exports and wallet investigations.
· Review company membership, property scope, modules and features after every role change.
· Remove company, device and session access promptly when an assignment ends.
· Use SecurityController@accessControl and @audits during periodic reviews.
· Record reasons and evidence for manual overrides, security exceptions and disabled controls.
Management Questions by Settings Area
|
Area |
Questions management should answer |
|
General |
Is the company identity accurate across profile, settings, emails and documents? |
|
Notifications |
Are important operational and security events delivered to monitored channels? |
|
Property / Client |
Do defaults match current policy, contract templates and legal requirements? |
|
Payments |
Are currency, tax, late fees, grace periods, partial payments and invoices correct? |
|
Reports |
Are schedules, fiscal year, file formats and recipients approved? |
|
Integrations |
Which systems are connected, who owns them and when were they last tested? |
|
Localization |
Are dates, times, reminders and calendar events interpreted correctly? |
|
Backups |
Have backup and restoration actually been verified? |
|
Modules / Features |
Are enabled capabilities required, entitled and supported? |
|
Security |
Is 2FA complete, access current, sessions known and alerts investigated? |
|
Client settings |
Can clients manage profile, privacy, notifications, billing and devices safely? |
|
SuperAdmin layer |
Are platform services healthy and material default changes communicated? |
Recommended Review Cadence
|
Frequency |
Review |
|
Daily |
Security alerts, failed integrations, payment webhooks, unknown sessions, wallet fraud alerts and urgent notification failures. |
|
Weekly |
New users, changed permissions, unresolved webhooks, report delivery, connected devices and client support issues. |
|
Monthly |
Payment defaults, report recipients, company identity, module usage, security statistics and backup-job evidence. |
|
Quarterly |
All setting groups, IP whitelist, 2FA coverage, integration owners, service credentials, feature toggles and access-control review. |
|
Annually |
Fiscal-year configuration, tax, legal policies, retention, password policy, business continuity and corporate entity records. |
|
Before rollout |
Pilot results, dependencies, permissions, notifications, integrations, security and rollback plan. |
|
After incident |
Sessions, devices, credentials, 2FA, IPs, permissions, wallets, alerts and corrective settings. |
|
Scenario |
|
Stage |
What happens |
|
1. Company profile |
Administrator creates HarbourGate Properties and adds the approved contact, website, tax ID and address. |
|
2. Localization |
Timezone is set to Africa/Lagos, date format to DD/MM/YYYY and time format to 24-hour. |
|
3. Notifications |
Email and push remain ON; SMS remains OFF; quiet hours are 22:00 to 07:00; maintenance and payment alerts remain ON. |
|
4. Appearance |
System theme, normal density, expanded sidebar and 25 items per page are selected. |
|
5. Communication |
Approved signature is added; auto-reply is enabled with the support response message; read receipts remain ON. |
|
6. Property defaults |
12-month term, approved maintenance threshold, six-month inspections, no pets, no smoking, renter’s insurance required and approved deposit. |
|
7. Client defaults |
Screening required, reminder 60 days before expiry, welcome email ON, co-signers allowed, expiry reminder 30 days and auto-renewal OFF. |
|
8. Payment defaults |
NGN is selected, approved tax and late-fee rules are entered, grace period is set, partial payments are disabled and invoice generation is tested. |
|
9. Reporting |
PDF, January fiscal-year start, monthly reports and an approved finance recipient list. |
|
10. Integrations |
Google Calendar sync is enabled and tested. Other integrations remain disabled until credentials and owners are approved. |
|
11. Backup |
Daily automatic encrypted backups, file inclusion and 30-day retention are selected; IT verifies a backup and restoration test. |
|
12. Modules |
Properties, Leases, Maintenance, CRM, Reporting and Document Hub remain enabled. Unused modules are hidden after dependency review. |
|
13. Features |
Required exports are enabled; AI and blockchain remain limited to approved roles; Lease Angel and SEPA remain disabled. |
|
14. Security |
2FA is enrolled for administrators, login alerts and activity logs remain ON, session timeout is 120 minutes and no IP whitelist is enforced until VPN design is complete. |
|
15. Users |
Property, finance and support users are added with minimum access and tested. |
|
16. Validation |
A pilot property, client, payment, report, notification, calendar event and security login are tested before rollout. |
Evidence Retained
· Approved configuration register and change records.
· Company and user list with roles.
· Screenshots or exports of saved sections without secrets.
· Test notification, report and calendar evidence.
· Payment and invoice test results.
· 2FA enrollment and recovery confirmation without the QR secret.
· Backup creation and restoration test.
· User acceptance testing and go-live approval.
Company and People
· ☐ Company entity and profile are created and approved.
· ☐ Primary contact email and phone are monitored.
· ☐ Tax ID, website and address are verified.
· ☐ Corporate and private landlord profile paths are tested as applicable.
· ☐ Staff list, roles, company membership and property scope are approved.
· ☐ Privileged users have individual accounts and 2FA.
Operating Defaults
· ☐ Notification channels, quiet hours and event preferences are approved.
· ☐ Appearance and communication defaults are tested.
· ☐ Property, inspection, pet, smoking, insurance and deposit policies are confirmed.
· ☐ Screening, guarantor, co-signer, welcome, document-expiry and renewal policies are confirmed.
· ☐ Currency, tax, late fees, grace period, partial payments and invoice rules are approved.
· ☐ Report format, fiscal year, schedule and recipients are approved.
· ☐ Timezone, date/time format, language and country are confirmed.
Technology, Data and Security
· ☐ API and integration owners are assigned.
· ☐ Webhook endpoints, verification and tests are completed.
· ☐ Google Calendar, QuickBooks, Slack and Zapier remain disabled unless fully configured.
· ☐ Backup frequency, retention, file inclusion and encryption are configured.
· ☐ A restoration test is completed.
· ☐ Required modules and features are enabled; unused ones are hidden after dependency review.
· ☐ Session timeout, login alerts, password expiry, IP policy and activity logging are approved.
· ☐ Active sessions, connected devices and access control are reviewed.
· ☐ Wallet risk and transaction-security responsibilities are assigned.
Client and Support Readiness
· ☐ Private and corporate client profile flows are tested.
· ☐ Notification and billing preferences are available to clients.
· ☐ Connected-device removal is tested.
· ☐ Privacy settings and account-deletion request handling are documented.
· ☐ Support contacts, escalation, incident and change procedures are agreed.
|
Test area |
Test case |
Expected result |
|
Settings Hub |
Open every authorised section as each staff role. |
Only permitted sections and actions are available. |
|
Defaults |
Open an account with no saved records. |
Defined defaults and profile-sourced values display correctly. |
|
General |
Save company identity and reopen. |
Values persist and the correct company is shown. |
|
Notifications |
Test email, SMS where configured, push and quiet hours. |
Each channel and time rule behaves as approved. |
|
Appearance |
Change theme, density, sidebar and page size. |
Preferences persist without unreadable screens. |
|
Communication |
Send a test message. |
Signature, auto-reply and read receipt behave correctly. |
|
Property defaults |
Create a test property/lease workflow. |
Approved defaults pre-populate and can be reviewed. |
|
Client defaults |
Create a test client/lease expiry. |
Screening and reminder behaviour follows configuration. |
|
Payments |
Create test invoices/payments. |
Currency, tax, late fees, grace, partial payment and invoices are correct. |
|
Reporting |
Generate and email a test report. |
Format, fiscal period, frequency and recipients are correct. |
|
Integration |
Use testWebhook and service tests. |
Authenticated events arrive once and update the correct record. |
|
Localization |
Review dates, times and scheduled events. |
Timezone and formats are correct. |
|
Backup |
Run backup and restoration test. |
Files/data are recoverable according to policy. |
|
Modules |
Disable and re-enable one test module. |
Navigation changes without data loss or unauthorised access. |
|
Features |
Toggle one test feature. |
Action visibility and permissions change as expected. |
|
2FA |
Enroll, log in, regenerate codes and verify recovery. |
2FA and recovery work; previous codes are invalidated when required. |
|
IP whitelist |
Test allowed and blocked networks. |
Access matches approved IP rules and emergency access works. |
|
Sessions |
Revoke a test session. |
The selected device is logged out. |
|
Audits |
Perform login, password and permission changes. |
Events include user, IP/device and timestamp. |
|
Wallet security |
Test alert, limit and transaction IP logging. |
Risk and audit data are visible to authorised users. |
|
Client mobile |
Update privacy, view devices and remove one. |
Changes apply to the correct client account. |
|
Data isolation |
Use two landlord accounts. |
One landlord cannot read or change the other’s settings. |
|
Go-live gate |
|
Issue |
Recommended action |
|
Saved value returns to default |
Confirm validation succeeded, correct group/key/user_id was used, cache was invalidated and the page was refreshed. |
|
General details differ from profile |
Compare Setting, Company and User values; confirm the authoritative source and any synchronization logic. |
|
User cannot see Settings |
Review role, company membership, route permission and module visibility. |
|
Wrong company is being edited |
Return to company dashboard and confirm entity context before saving. |
|
Notification not received |
Check channel toggle, contact details, quiet hours, service configuration, notification record and delivery logs. |
|
Quiet hours occur at wrong time |
Check timezone and overnight start/end handling. |
|
Appearance does not persist |
Confirm user-scoped save, browser refresh and cache/local preference handling. |
|
Auto-reply not sent |
Confirm auto_reply is ON, message exists, inbound message flow is supported and mail service is healthy. |
|
Property default is wrong |
Check saved landlord_property value and any User-derived default. |
|
Maintenance threshold unclear |
Confirm the currency and approval logic in the live implementation. |
|
Renewal reminder missing |
Check lease end date, reminder days, notifications, timezone and scheduler. |
|
Lease renewed unexpectedly |
Check auto_renew_leases and the live renewal job/workflow; review audit logs. |
|
Late fee incorrect |
Check method, amount, grace period, lease terms, currency and tax treatment. |
|
Partial payment behaviour unexpected |
Confirm accept_partial_payments and balance-allocation logic. |
|
Scheduled report not delivered |
Check email_reports_enabled, frequency, recipients, scheduler and email service. |
|
Webhook test fails |
Check HTTPS URL, authentication/signature, network access, supported event, logs and receiver response. |
|
Webhook creates duplicates |
Review idempotency and unique event/transaction handling. |
|
Calendar sync missing |
Check integration toggle, authorisation, calendar permissions, timezone and event mapping. |
|
Backup toggle ON but no backup |
Verify backup service, schedule, storage, logs and permissions; the setting alone is not execution evidence. |
|
Disabled module still accessible |
Check route/permission enforcement and cache; hiding navigation is not sufficient security. |
|
Enabled feature not available |
Confirm parent module, subscription entitlement, permission and required platform/integration setup. |
|
2FA enabled but login does not prompt |
Verify advanced enrollment, secret storage, TOTP verification and middleware/configuration. |
|
User locked out by IP whitelist |
Use the approved emergency access path and remove/correct the IP record. |
|
Unknown active session |
Revoke the session, change password, review 2FA, devices, audits and wallet activity. |
|
Audit log missing event |
Confirm activity_logging, event instrumentation, permissions and date filters. |
|
Client cannot remove device |
Confirm device ID belongs to the client and session/device service is available. |
|
Account deletion unclear |
Review the live GDPR workflow, identity verification, legal retention and request status. |
|
Support information to include |
Where are landlord settings stored?
In the Setting model as grouped key-value records with key, value, group, type and description; user-scoped updates also use user_id.
What happens before I save a setting?
The section displays saved records merged with defined defaults. Some fields can begin with Company or User profile values.
Does every displayed value already exist in the database?
No. A default can be displayed even when no Setting row exists.
Can different landlords use different settings?
Yes. The supplied update pattern scopes records by authenticated user ID.
Can a corporate landlord manage multiple companies?
Yes, through CompanyController company CRUD, dashboards and user management.
Can I disable a complete module?
Yes. updateModules stores module states and disabled modules are hidden from landlord/staff navigation.
Does disabling a module delete its data?
The supplied scenario only states that it is hidden. It does not state that records are deleted.
Can I disable one feature without disabling a module?
Yes, through granular feature toggles, subject to parent-module and entitlement dependencies.
Does enabling an integration complete setup?
Not necessarily. Credentials, authorisation, endpoints, verification and tests may also be required.
Can Leaseora test webhooks?
WebhookApiController includes testWebhook, and SuperAdmin has WebhookMonitorController.
Can the company use two-factor authentication?
Yes. Advanced controls support QR enrollment, verification and backup codes.
What happens when backup codes are regenerated?
The supplied design states that previous backup codes are invalidated.
Can access be restricted by IP?
Yes, through basic IP settings and advanced whitelist records.
Can I log out a lost device?
Yes. Use session revocation and mobile connected-device removal.
Does Leaseora detect fraud?
The security controllers provide transaction fraud analysis, anomaly scanning and wallet-specific alerts/patterns.
Can a fraud alert automatically prove wrongdoing?
No. Alerts require investigation and evidence.
Can clients manage their own settings?
Yes. Private and corporate clients can manage profile, notifications, billing, privacy, devices and IoT preferences through supported controllers.
Can a client delete an account?
MobileProfileSettingsController can initiate GDPR account deletion; the complete retention and verification process must be confirmed in the live build.
Who controls platform defaults?
Leaseora SuperAdmin through platform-wide SettingsController and specialised settings controllers.
Why did a setting save but the workflow not change?
The downstream module, integration, scheduler, cache, entitlement or production implementation may not be connected or configured.
1. Open the Settings Hub and confirm the correct account and role.
2. Configure General company identity and company users.
3. Configure notification channels, quiet hours and event alerts.
4. Choose theme, compact mode, sidebar state and page size.
5. Configure signature, auto-reply and read receipts.
6. Set property, lease, maintenance, inspection, policy and deposit defaults.
7. Set client screening, renewal, welcome, guarantor, co-signer and document-expiry defaults.
8. Set currency, tax, late fees, grace period, partial payments and invoices.
9. Set report format, fiscal year, schedule and recipients.
10. Configure and test API, webhooks, Slack, calendar, accounting and automation.
11. Set timezone, date/time format, language and country.
12. Configure backup frequency, retention, file inclusion and encryption; test restoration.
13. Enable or disable complete modules after dependency review.
14. Enable or disable granular features after entitlement and permission review.
15. Configure baseline 2FA, sessions, login alerts, password expiry, IP and activity logging.
16. Complete advanced 2FA, IP, fraud, anomaly and event configuration.
17. Monitor active sessions, access control and audits; revoke suspicious sessions.
18. Review wallet fraud, patterns, limits, IPs, audits and transaction 2FA.
19. Save each settings group, reopen it and validate the downstream workflow.
20. Understand platform-wide SuperAdmin defaults and service health.
21. Test client profile, privacy, billing, notifications, devices and IoT settings.
22. Manage corporate entities and company users with least-privilege access.
Core Models and Traits
|
System |
Purpose |
|
Setting |
Core grouped key-value model with key, value, group, type and description; user-scoped persistence also uses user_id. |
|
User |
Profile and account record; supplies company_name, email, phone, address, default lease duration, default deposit and renewal notice period where described. |
|
Company |
Company identity including company_name, email, phone, website, tax_id and business_address/address. |
|
Notification |
Stores notifications used by landlord and client notification centres. |
|
HasBreadcrumbs |
Trait used by settings views to provide breadcrumb navigation. |
Landlord Controllers
|
Controller |
Responsibility |
|
Landlord\Shared\SettingsController |
Settings Hub and grouped sections: general, notifications, appearance, communication, property, tenant, payment, reporting, integration, localization, backup, modules, features, security and update handlers. |
|
Landlord\Shared\SecurityManagementController |
Advanced 2FA, QR, backup codes, IP whitelist, fraud detection, anomaly detection, security events, settings and statistics. |
|
Landlord\Shared\SecurityController |
Security dashboard, live monitoring, access control, audits and session revocation. |
|
Landlord\Shared\WalletSecurityController |
Wallet fraud alerts, patterns, investigations, risk dashboard, transaction limits, IP logs, audits, 2FA status and recommendations. |
|
Landlord\Shared\CompanyController |
Company CRUD, dashboards, user management and summary. |
|
Landlord\Shared\NotificationController |
Landlord notification centre and notification sending. |
|
CorporateLandlordProfileController |
Corporate landlord profile show/store. |
|
PrivateLandlordProfileController |
Private landlord profile show/store. |
|
Shared\ProfileController |
Base shared profile management. |
Mobile and Client Controllers
|
Controller |
Responsibility |
|
API\Mobile\Shared\MobileProfileSettingsController |
Profile, personal data, photo, password, phone, email, privacy, activity log, connected devices, device removal and account deletion. |
|
Users\Tenant\Share\TenantProfileController |
Shared client profile management. |
|
Users\Tenant\Private\PrivateTenantProfileController |
Private client profile. |
|
Users\Tenant\Corporate\CorporateTenantProfileController |
Corporate client profile. |
|
Users\Tenant\Corporate\CompanyProfileController |
Corporate client company profile. |
|
Users\Tenant\Share\BillingController |
Client billing management. |
|
Users\Tenant\Corporate\CorporateBillingController |
Corporate client billing. |
|
API\Mobile\Tenant\CorporateBillingController |
Mobile corporate billing. |
|
Users\Tenant\Share\NotificationController / NotificationsController |
Client notification preferences. |
|
API\Mobile\Tenant\NotificationController |
Mobile notification list and read status. |
|
Users\Tenant\Share\TenantIoTPreferencesController |
Client IoT preferences and alerts. |
Platform and Specialised Controllers
|
Controller |
Responsibility |
|
SuperAdmin\Core\SettingsController |
Platform-wide groups, defaults and email/KYC/AI testing. |
|
SuperAdmin\Core\PaymentSettingsController |
Platform and landlord payment settings. |
|
SuperAdmin\Core\WalletSettingsController |
Wallet settings, rates and markup. |
|
SuperAdmin\Core\MofiSettingsController |
Mofi payment configuration. |
|
SuperAdmin\Core\AuthPageSettingsController |
Authentication-page appearance. |
|
SuperAdmin\Core\SecurityComplianceController |
Platform security and compliance. |
|
SuperAdmin\Core\AIIntegrationController |
AI services and tests. |
|
SuperAdmin\Core\NotificationController |
Platform notification management. |
|
SuperAdmin\Core\WebhookMonitorController |
Platform webhook monitoring. |
|
Wallet\TransactionSecurityController |
Transaction-level wallet security. |
|
Agency\SettingsController |
Agency-specific settings. |
|
API\CreditSettings\CreditSettingsController |
Credit-related settings. |
|
Group key |
Section |
Settings stored |
|
landlord_general |
General |
company_name, contact_email, contact_phone, website, tax_id, address |
|
landlord_notifications |
Notifications |
email_alerts, sms_alerts, push_notifications, quiet_hours_start, quiet_hours_end, maintenance_updates, payment_received |
|
landlord_appearance |
Appearance |
theme, compact_mode, sidebar_collapsed, items_per_page |
|
landlord_communication |
Communication |
email_signature, auto_reply, auto_reply_message, send_read_receipts |
|
landlord_property |
Property |
default_lease_term, maintenance_threshold, inspection_frequency, allow_pets_default, smoking_allowed, require_renters_insurance, default_security_deposit |
|
landlord_tenant |
Client / Tenant |
screening_required, auto_renewal_reminder, welcome_email_enabled, require_guarantor, allow_cosigners, document_expiry_reminder, auto_renew_leases |
|
landlord_payment |
Payment |
default_currency, default_tax_rate, late_fee_method, late_fee_amount, grace_period_days, accept_partial_payments, auto_generate_invoices |
|
landlord_reporting |
Reporting |
default_report_format, fiscal_year_start, email_reports_enabled, report_frequency, report_recipients |
|
landlord_integration |
Integration |
api_enabled, webhook_url, slack_webhook_url, google_calendar_sync, quickbooks_integration, zapier_enabled |
|
landlord_localization |
Localization |
timezone, date_format, time_format, language, country |
|
landlord_backup |
Backup |
auto_backup_enabled, backup_frequency, retention_days, include_files, encrypted_backups |
|
landlord_security |
Security |
two_factor_auth, session_timeout, login_notifications, password_expiry, ip_whitelist, activity_logging |
|
modules |
Modules |
Enable/disable state for complete platform modules. |
|
features |
Features |
Enable/disable state for granular capabilities. |
Default Values Supplied
|
Group |
Key |
Default |
|
landlord_notifications |
email_alerts |
ON |
|
landlord_notifications |
sms_alerts |
OFF |
|
landlord_notifications |
push_notifications |
ON |
|
landlord_notifications |
quiet_hours_start |
22:00 |
|
landlord_notifications |
quiet_hours_end |
07:00 |
|
landlord_notifications |
maintenance_updates |
ON |
|
landlord_notifications |
payment_received |
ON |
|
landlord_appearance |
theme |
system |
|
landlord_appearance |
compact_mode |
OFF |
|
landlord_appearance |
sidebar_collapsed |
OFF |
|
landlord_appearance |
items_per_page |
10 |
|
landlord_communication |
email_signature |
empty |
|
landlord_communication |
auto_reply |
OFF |
|
landlord_communication |
auto_reply_message |
Thank you... |
|
landlord_communication |
send_read_receipts |
ON |
|
landlord_property |
default_lease_term |
12 months |
|
landlord_property |
maintenance_threshold |
500 |
|
landlord_property |
inspection_frequency |
6 months |
|
landlord_property |
allow_pets_default |
OFF |
|
landlord_property |
smoking_allowed |
OFF |
|
landlord_property |
require_renters_insurance |
ON |
|
landlord_property |
default_security_deposit |
0 |
|
landlord_tenant |
screening_required |
ON |
|
landlord_tenant |
auto_renewal_reminder |
60 days |
|
landlord_tenant |
welcome_email_enabled |
ON |
|
landlord_tenant |
require_guarantor |
OFF |
|
landlord_tenant |
allow_cosigners |
ON |
|
landlord_tenant |
document_expiry_reminder |
30 days |
|
landlord_tenant |
auto_renew_leases |
OFF |
|
landlord_backup |
auto_backup_enabled |
ON |
|
landlord_backup |
retention_days |
30 |
|
landlord_backup |
include_files |
ON |
|
landlord_backup |
encrypted_backups |
ON |
|
landlord_security |
two_factor_auth |
OFF |
|
landlord_security |
session_timeout |
120 minutes |
|
landlord_security |
login_notifications |
ON |
|
landlord_security |
password_expiry |
90 days |
|
landlord_security |
ip_whitelist |
empty |
|
landlord_security |
activity_logging |
ON |
|
No defaults supplied for some groups |
|
Action |
Responsibility |
|
index |
Return the settings hub. |
|
general |
Load landlord_general values from Company/User and stored settings. |
|
notifications |
Load landlord_notifications. |
|
appearance |
Load landlord_appearance. |
|
communication |
Load landlord_communication. |
|
property |
Load landlord_property and User-derived lease/deposit defaults. |
|
tenant |
Load landlord_tenant and User-derived renewal notice. |
|
payment |
Load landlord_payment. |
|
reporting |
Load landlord_reporting. |
|
integration |
Load landlord_integration. |
|
localization |
Load landlord_localization. |
|
backup |
Load landlord_backup. |
|
modules |
Display module toggles. |
|
updateModules |
Persist complete module states. |
|
features |
Display granular feature toggles. |
|
updateFeatures |
Persist granular feature states. |
|
security |
Load landlord_security. |
|
update |
Validate and save ordinary section settings; invalidate group cache and return success. |
|
getSettingsWithDefaults |
Private helper that merges stored records with section definitions and defaults. |
Persistence and Cache Flow
|
Stage |
Technical behaviour |
|
Request |
The form sends setting keys, values, group and type information according to the section implementation. |
|
Validation |
The controller validates values against rules and allowed choices. |
|
Iteration |
Each setting key is processed separately. |
|
Lookup |
The record is identified by key, group and auth()->id(). |
|
Update/Create |
Setting::updateOrCreate updates an existing row or creates a new row. |
|
Value storage |
value and type are saved according to the submitted/defined data. |
|
Cache invalidation |
The relevant group cache is cleared. |
|
Response |
A success notification or validation error is returned. |
SecurityManagementController Actions
|
Action |
Responsibility |
|
twoFactorAuth |
View 2FA status/configuration. |
|
enableTwoFactor |
Enable 2FA and return QR code and backup codes. |
|
disableTwoFactor |
Disable 2FA after verification. |
|
verifyTwoFactor |
Validate a TOTP code. |
|
generateQR |
Regenerate the authenticator QR code. |
|
generateBackupCodes |
Create new one-time recovery codes and invalidate previous codes. |
|
ipWhitelist |
View allowed IP records. |
|
addIPToWhitelist |
Add an allowed IP. |
|
removeIPFromWhitelist |
Remove a whitelist record. |
|
fraudDetection |
View fraud alerts/dashboard. |
|
analyzeTransaction |
Submit a transaction for fraud analysis. |
|
resolveFraudAlert |
Resolve an alert with the supplied alert ID. |
|
anomalyDetection |
View anomaly patterns. |
|
scanForAnomalies |
Run an anomaly scan. |
|
securityEvents |
View security events with filters. |
|
settings |
View advanced security settings. |
|
updateSettings |
Save advanced security settings. |
|
statistics |
Return security statistics. |
SecurityController Actions
|
Action |
Responsibility |
|
dashboard |
Security overview, active sessions, recent logins, flags, health score and recent events. |
|
monitoring |
Live sessions, IP monitoring and login-frequency patterns. |
|
accessControl |
Staff access levels, permission assignments and unusual access. |
|
audits |
Full audit log with event, user, IP, device and timestamp; export where supported. |
|
revokeSession |
Revoke a specific active session token. |
WalletSecurityController Actions
|
Action |
Responsibility |
|
index |
Wallet security overview. |
|
fraudAlerts |
Wallet fraud alerts. |
|
fraudPatterns |
Detected wallet fraud patterns. |
|
investigate |
Open an investigation. |
|
riskDashboard |
Wallet risk dashboard. |
|
validateTransactionLimit |
Pre-transaction limit validation. |
|
logTransactionIp |
Record transaction IP. |
|
auditLogs |
Wallet audit logs. |
|
twoFactorStatus |
Wallet transaction 2FA status. |
|
recommendations |
Wallet security recommendations. |
Security Data Requiring Protection
· Authenticator secrets and QR codes.
· Backup/recovery codes.
· Passwords and password-reset tokens.
· Webhook URLs, signatures, secrets and API credentials.
· IP whitelist details where security-sensitive.
· Fraud evidence, device fingerprints and transaction IPs.
· Audit exports containing personal or security information.
· Service error logs that may expose configuration details.
|
Controller |
Actions / type |
Purpose |
|
CrmWebhookInboundController |
handle; verify |
Inbound CRM leads from external portals and authenticity verification. |
|
WebhookApiController |
index; store; destroy; testWebhook |
Manage and test outbound webhook endpoints. |
|
KycWebhookController |
Webhook handler |
General KYC verification events. |
|
VeriffWebhookController |
Callback handler |
Veriff identity-verification events. |
|
FlutterwaveTransferWebhookController |
Webhook handler |
Flutterwave transfer statuses. |
|
FlutterwaveVASWebhookController |
Webhook handler |
Flutterwave value-added-service events. |
|
SquadWebhookController |
Webhook handler |
Squad payment events. |
|
SolarisWebhookController |
Webhook handler |
Solaris banking events. |
|
EmbedlyWebhookController |
Webhook handler |
Embedly wallet and virtual-account events. |
|
MofiWebhookController |
Webhook handler |
Mofi payment events. |
|
DocuSignWebhookController |
Webhook handler |
DocuSign e-signature events. |
|
PayPalWebhookController |
Webhook handler |
PayPal payment events. |
|
WebhookMonitorController |
Monitoring dashboard |
Platform-wide webhook visibility and health. |
AI Service Actions
|
Controller / action |
Technical purpose |
|
AIIntegrationController |
Manage AI providers and integration configuration. |
|
SettingsController@checkAiService |
Check AI service health. |
|
@testAiChat |
Exercise the AI chat flow. |
|
@testAiConnection / @testOpenai |
Verify provider connectivity. |
|
@checkAiConfig |
Validate configuration presence/format. |
|
@getAiErrorLogs |
Retrieve AI service error logs. |
|
@testAiChatService |
Test a selected AI chat service. |
SuperAdmin Settings Actions
|
Action |
Purpose |
|
index |
List platform settings. |
|
specialized |
View a named group. |
|
getAllSettingsGroups |
Return group names. |
|
update |
Update platform settings. |
|
getSettings |
Return settings JSON. |
|
landlordNotifications |
Landlord notification defaults. |
|
landlordGeneral |
Landlord general defaults. |
|
notifications |
System notification settings. |
|
payment |
Platform payment settings. |
|
adCharges |
Advertising charges. |
|
testEmail / emailTesting / testEmailService |
Email service tests. |
|
kycTesting / testVeriffConnection / createTestVeriffSession |
KYC/Veriff tests. |
|
aiChatTesting / checkAiService / testAiChat |
AI chat and health tests. |
|
testAiConnection / testOpenai / checkAiConfig |
AI provider/configuration tests. |
|
getAiErrorLogs / testAiChatService |
AI error review and service-specific test. |
|
show |
View an individual setting record. |
MobileProfileSettingsController Actions
|
Action |
Purpose |
|
getProfile |
Fetch full profile. |
|
updatePersonalInfo |
Update personal information. |
|
uploadPhoto / deletePhoto |
Manage profile photo. |
|
changePassword |
Change password. |
|
updatePhone / updateEmail |
Change contact information. |
|
getPrivacySettings / updatePrivacySettings |
View and update privacy preferences. |
|
getActivityLog |
View account activity. |
|
getConnectedDevices |
List connected devices. |
|
removeDevice |
Disconnect a device. |
|
deleteAccount |
Initiate GDPR deletion. |
CompanyController Actions
|
Action |
Purpose |
|
index |
View linked companies. |
|
create / store |
Create a company profile. |
|
show |
View company details. |
|
edit / update |
Update company details. |
|
destroy |
Delete a company subject to dependencies. |
|
dashboard |
Per-company management dashboard. |
|
manageUsers |
Manage entity users. |
|
addUser |
Grant company membership/access. |
|
removeUser |
Revoke company membership/access. |
|
summary |
Company portfolio summary. |
The supplied scenario defines the intended Settings module structure and named backend systems. The following details are not fully specified and should be confirmed from the current code, database, routes, jobs, middleware, service providers and infrastructure before formal production sign-off.
|
Area |
Confirmation required |
|
Profile synchronisation |
Whether saving landlord_general updates Company/User fields, Setting rows only, or both. |
|
Exact validation rules |
Maximum lengths, allowed URLs, phone formats, numeric ranges and select enumerations. |
|
Value serialization |
How Boolean, number, list and multiline values are cast and stored in Setting.value. |
|
Cache keys and lifetime |
Exact cache names, scope and invalidation behaviour. |
|
Settings inheritance |
Whether platform defaults, company values and user settings have additional precedence rules. |
|
Module enforcement |
Whether disabled modules are only hidden or also blocked by routes, policies and APIs. |
|
Feature entitlement |
How subscription plan, SuperAdmin and landlord toggles combine. |
|
Maintenance currency |
Which currency applies to maintenance_threshold. |
|
Payment details |
Default currency source, tax scope, late-fee calculation, partial allocation and invoice numbering. |
|
Scheduling |
Jobs and timing for reminders, reports, backups and auto-renewal. |
|
Quiet-hour bypass |
Which urgent event categories can bypass quiet hours. |
|
Integration authorisation |
OAuth flows, credentials, secrets, scopes and disconnect behaviour for calendar, accounting and automation. |
|
Webhook security |
Signature algorithms, replay protection, retries, idempotency and event retention. |
|
Backup infrastructure |
Backup engine, storage, key management, restore process and tenant isolation. |
|
2FA implementation |
Authenticator library, encryption of secrets, recovery flow and enforcement middleware. |
|
IP whitelist enforcement |
CIDR support, IPv6, proxies, VPNs, trusted headers and emergency access. |
|
Fraud/anomaly services |
Data inputs, thresholds, model/provider, false-positive handling and decision authority. |
|
Audit retention |
Retention, export format, access permissions and immutability. |
|
GDPR deletion |
Identity checks, retention exceptions, legal holds, status, delay and notification. |
|
Client route names |
Exact /tenant/settings and /tenant/profile routes and mobile endpoint contracts. |
|
Training must match the live build |
Appendix A - Setting Field Types
|
Type |
Use |
Validation examples |
|
text |
Short names, IDs, phone, country or recipient text. |
Required/optional, length, allowed characters. |
|
textarea |
Address, signature, auto-reply and IP list. |
Length, line breaks, sanitization and secret handling. |
|
email |
Contact email and report recipients. |
Valid email format and monitored mailbox. |
|
url |
Website and webhook addresses. |
Valid HTTPS URL where security requires it. |
|
boolean |
Enable/disable controls. |
Normalise checkbox absence and explicit false. |
|
number |
Terms, thresholds, rates, fees, days and timeout. |
Numeric range, decimal/integer and unit. |
|
time |
Quiet-hour start/end. |
Valid 24-hour value and timezone interpretation. |
|
select |
Theme, page size, frequency, format and method. |
Allow only defined options. |
|
Group |
Owner |
Approval / test evidence |
|
landlord_general |
Company Administrator |
Identity/profile comparison and sample output. |
|
landlord_notifications |
Operations |
Channel and quiet-hour test. |
|
landlord_appearance |
User / Administrator |
Visual persistence test. |
|
landlord_communication |
Communications |
Test email and auto-reply. |
|
landlord_property |
Property / Legal |
Test property/lease defaults. |
|
landlord_tenant |
Leasing / Compliance |
Test client and reminder workflow. |
|
landlord_payment |
Finance |
Invoice/payment calculation test. |
|
landlord_reporting |
Finance / Management |
Sample report and recipient test. |
|
landlord_integration |
IT / Integration Owner |
Endpoint/service test and logs. |
|
landlord_localization |
Administrator |
Date/time/timezone test. |
|
landlord_backup |
IT / Security |
Backup and restore evidence. |
|
modules |
Director / System Owner |
Dependency and navigation test. |
|
features |
Product Owner / Director |
Entitlement, permission and feature test. |
|
landlord_security |
Security / IT |
2FA, session, IP and audit tests. |
|
Change level |
Examples |
Suggested control |
|
Low |
Theme, compact mode, sidebar and page size. |
User-level save and visual verification. |
|
Moderate |
Signature, auto-reply, quiet hours, report format and reminder days. |
Section-owner review and workflow test. |
|
High |
Currency, tax, late fees, partial payments, report recipients, integrations, modules and features. |
Documented approver, test evidence and rollback. |
|
Critical |
Auto-renewal, 2FA disablement, IP whitelist enforcement, password policy, security logging, wallet limits, company deletion and account deletion. |
Dual approval, controlled window, incident/rollback readiness and post-change audit. |
|
Field |
Purpose |
|
Event type |
Login, logout, failed login, password, 2FA, permission, setting or wallet action. |
|
User and company |
Identify the account and legal/operating context. |
|
Date/time/timezone |
Establish the chronological sequence. |
|
IP and device |
Identify source network and device context. |
|
Action/result |
Succeeded, failed, blocked, revoked or resolved. |
|
Related setting/record |
Connect the event to the changed key, session, alert or transaction. |
|
Reviewer and decision |
Record who investigated and what was concluded. |
|
Evidence reference |
Link to preserved logs, ticket or case without exposing secrets. |
|
Field |
What to record |
|
Integration name and owner |
Service and responsible person/team. |
|
Business purpose |
Why the connection is required. |
|
Environment |
Test, staging or production. |
|
Endpoint / account reference |
Controlled reference; avoid placing secrets in general registers. |
|
Authentication method |
OAuth, signature, API key or other supported method. |
|
Events / data |
What is sent or received. |
|
Verification and idempotency |
How authenticity and duplicate protection work. |
|
Last successful test |
Date, evidence and tester. |
|
Monitoring / alert |
Where failures are visible. |
|
Disable / recovery plan |
How to stop or restore the integration. |
|
Term |
Definition |
|
2FA / TOTP |
Two-factor authentication using a time-based one-time code from an authenticator application. |
|
Backup code |
One-time recovery code used when the authenticator is unavailable. |
|
Cache invalidation |
Removal of a cached settings result so the next read uses the new value. |
|
Company context |
The legal or operating entity in which a user is working. |
|
Effective setting |
The value returned after defaults, saved records and profile sources are combined. |
|
Feature toggle |
Switch for a granular capability inside a module. |
|
Fraud alert |
Risk signal about a transaction or account activity requiring investigation. |
|
Idempotency |
Processing the same event more than once without creating duplicate outcomes. |
|
IP whitelist |
List of allowed source IP addresses. |
|
Module toggle |
Switch for a complete Leaseora module. |
|
Quiet hours |
Configured period in which non-urgent notifications should be suppressed or delayed. |
|
Setting group |
Namespace that organises related keys. |
|
Setting key |
Unique name of one configurable option. |
|
Session revocation |
Immediate invalidation of an active login session. |
|
SuperAdmin default |
Platform-level setting or initial value managed above landlord accounts. |
|
Webhook |
HTTP event sent between Leaseora and an external service. |
|
Task |
Fast path |
|
Company identity |
Settings -> General -> verify company -> edit -> save -> check profile/output. |
|
Notifications |
Settings -> Notifications -> channels -> quiet hours -> event toggles -> save -> test. |
|
Property/client defaults |
Settings -> Property or Client -> approve values -> save -> create a controlled test record. |
|
Payments |
Settings -> Payment -> currency/tax/late fee/grace/partial/invoice -> save -> test calculation. |
|
Reports |
Settings -> Reporting -> format/fiscal year/schedule/recipients -> save -> send test. |
|
Integration |
Settings -> Integration -> owner/endpoint/toggle -> verify -> testWebhook/service test -> review logs. |
|
Localization |
Settings -> Localization -> timezone/formats/language/country -> save -> test dates and schedules. |
|
Backup |
Settings -> Backup -> schedule/retention/files/encryption -> save -> verify backup and restore. |
|
Modules/features |
Settings -> Modules or Features -> dependency/entitlement review -> change -> test access and data. |
|
2FA |
Security Management -> enable -> scan QR -> verify code -> store backup codes -> test login. |
|
Unknown session |
Security Dashboard -> sessions -> review -> revoke -> password/2FA/device/audit review. |
|
Wallet alert |
Wallet Security -> alert -> investigate -> check limits/IP/2FA -> resolve or escalate with evidence. |
|
Final operating principle |
LEASEORA
SETTINGS
One governed configuration layer for company operations, client experience, integrations and security.
Support and onboarding
For corporate onboarding, staff training or operational support, contact Leaseora at support@leaseora.com.
leaseora.com
Tags
Was this article helpful?
Your feedback helps us improve our documentation.