AI and security for property management
Other people's money, tenant data and payment runs that have to be on time every month. Where we start at property managers. And which recurring work can go first.
The situation
A property manager manages money that is not its own: rent accounts, renovation funds, payments to contractors on behalf of the owners. On top of that comes the data of thousands of tenants, from credit checks to damage reports with photos from the flat.
Day-to-day work runs through property management software, email and portals, with many parties involved: caretakers, contractors, owners, condominium administrations. Invoices come from everywhere, and a forged contractor invoice does not stand out in the monthly run if nobody looks for it.
Institutional owners and pension funds now ask how data and security are handled when they award mandates. The Data Protection Act makes management personally liable for tenant data. Both hit businesses that have no position for it.
What a property manager needs is not new technology, but clear responsibility, a checked procedure for payments and an answer that is ready when an owner asks.
What we find in this industry
- Payments to contractors and owners are the targetHundreds of invoices a month from changing senders. A changed IBAN in a genuine email thread does not stand out without a fixed check.
- Tenant data is personal, and there is a lot of itCredit reports, debt collection extracts, photos from flats, damage reports. The Data Protection Act holds management responsible for it, not the software vendor.
- Many parties, many loginsCaretakers, contractors, owners and administrations have access to portals and documents. Who revokes it when the mandate ends or the caretaker changes?
- The monthly run cannot afford an outageRents, service charges, owner statements: an encrypted server at month end hits owners and tenants at the same time.
- IT depends on the industry software and an external providerBoth do what has been ordered. In most businesses nobody orders backup tests, access reviews and emergency plans.
- Owners ask for evidencePension funds and investment foundations review their property managers. Without a provable answer you lose mandates before fees are even discussed.
Where the time goes in property management, and what we build there
These are the workflows we ask about in the first conversation, because we find them at property managers again and again.
Where the time goes
- Owner reporting by handEvery quarter the same package is built from the property management software, the bank and email. Per owner, per property, by hand.
- Tenant mail and damage reports triagedEvery message is read, classified, forwarded and answered. Most of them resemble an earlier one.
- Contractor quotes and invoices reconciledQuote, order, invoice, budget: four documents, checked against each other by hand.
- Knowledge about properties held by one personThe property manager knows which heating system has which quirk and which tenant has which arrangement. If he is away, the stand-in starts from zero.
- Owners ask the same questions againService charges, renovation fund, vacancies. The answer is in an earlier email, but nobody finds it.
- Owners' meetings and minutes cost eveningsInvitation, agenda, minutes, follow-up on resolutions. For every condominium owners' association, every year.
What we build
- Owner reporting from the running dataThe quarterly package is built from the property management software and the bank, in your format. The property manager comments instead of building.
- Triage of tenant mailMessages are read, classified and prepared with a suggested reply. Your people decide and send.
- Property dossier before every appointmentHistory, open items, arrangements, last decisions. Readable for the stand-in too.
- Invoice check with its historyNext to every contractor invoice are the quote, the order and the budget. Deviations are marked before anyone approves.
Where we would start: Start with owner reporting. The data is there, the workflow does not change, and the effect is visible in the next quarter.
Typical trigger
A contractor invoice with a changed account number gets paid. Or an institutional owner asks, before awarding the mandate, for proof of how tenant data and funds are protected.
The ODCUS difference
No selling of additional tools. The first step is always: what do you already have, what of it works, and what can we cut? Most mandates start by reducing cost and improving protection at the same time.
Why these services fit
Payments and access first, then the rest
At a fixed price we assess the current state: invoice checks, approvals, email protection, third-party access, backup. Prioritised by what costs a property manager real money and mandates.
Duplicate tools and unused licences almost always turn up along the way. They pay for part of the measures.
Approvals, access and providers under control, without disrupting the monthly run
We introduce a fixed check for account changes, put the access of caretakers, contractors and owners in order, and give the IT provider clear tasks. Implemented between the monthly runs.
Your property managers stay with the properties. We work through the backlog and hand over so that it does not build up again.
The answer for owners and pension funds is ready
A lean ISMS documents once how funds and tenant data are protected. That answers the questions of institutional owners before they are asked.
Where an owner requires ISO 27001, we support you through to the certificate.
A responsible person you do not have to hire
One to two days a month: set priorities, steer providers and software vendors, build staff awareness, report to management and the owners.
The mandate can be scaled back as soon as the order is in place.
Who it is for
- Property managers and property administrations with 30 to 150 employees and no in-house IT role
- Businesses that execute payments on behalf of owners
- Administrations with institutional owners who ask for evidence
- Businesses with many external logins: caretakers, contractors, condominium owners
Related engagements
- Microsoft 365 hardening: email protection and access at a services company
- Privileged access put in order: who may do what, traceably
- Ransomware recovery after full encryption
Anonymised looks at real engagements. Not all of them come from this industry, but the task is the same.
FAQ
Our industry software runs in the vendor's cloud. Does that not make us secure?
The vendor protects its platform. Who has access on your side, whether accounts have a second factor, how invoices are checked and what happens with email and storage remains your business. That is where the incidents happen.
How do we prevent a forged contractor invoice from being paid?
With a fixed check for every account change that does not run by email, and a four-eyes principle above an amount threshold. Both are introduced in days and need no new software.
An owner asks for proof of security. What can we deliver at short notice?
A provable state: what is protected, how, and what is still to come by when. That is enough in most mandate awards. A certificate is the second step, if the owner explicitly asks for it.
Let us talk about your situation
Thirty minutes, free and without obligation. We tell you honestly whether and where we can help.