We already use AgentOS. Will Purple Pepper replace it or fight with it?

Purple Pepper is built to work alongside AgentOS, not against it. A two-way sync keeps core records — tenancies, landlord details, compliance certificates, and tenancy agreements — consistent across both platforms. When a holding deposit is paid, Purple Pepper pushes the let-agreed status to AgentOS and flips the property off portals automatically. Compliance documents (gas safety, EPC, EICR) can be pulled directly from AgentOS, and any missing certificates surface as a visible warning rather than a silent gap. Tenancies created in Purple Pepper sync back into AgentOS so neither system becomes stale.

How does the e-signing workflow actually work — do tenants need to download an app?

No download required. Purple Pepper generates a single web page containing all transaction documents — tenancy agreement or occupation contract, compliance pack, prescribed information, and deposit certificates — accessible via a secure link on any phone, tablet, or desktop. Signing happens in three stages: the tenancy or occupation contract first, then the pre-move-in compliance pack, then the post-move-in deposit declaration. You can configure parallel signing (any party, any time) or sequential signing (all tenants before landlord). A colour-coded status indicator shows exactly which party the envelope is currently waiting on. If a tenant loses the email or it lands in spam, a one-click resend is available at every stage without cancelling existing signatures. The system also produces a date- and time-stamped proof-of-service record showing when documents were sent and opened, usable as court evidence even where a tenant has not yet signed.

What happens between offer acceptance and a tenant moving in — how much manual data entry is involved?

Very little. Once an offer is accepted, a single button launches the five-stage tenancy setup wizard with applicant names, emails, employment status, and joint applicant details already filled in from the offer submission. The wizard takes agents through property and dates, rent and deposit calculations (with legally correct deposit caps enforced by country — England, Wales, Scotland, or Northern Ireland), tenants and guarantors, cost breakdown and holding deposit, and the draft tenancy agreement. Default to-do checklists defined in your company settings are applied automatically to every new tenancy, so nothing gets missed. Automated welcome emails go to all tenants on completion, and the tenant portal opens immediately with their assigned tasks ready to action. If a tenancy was originally managed outside Purple Pepper, a legacy onboarding path lets you bring it in and run it through the same renewal workflow as any platform-native tenancy.

How does Purple Pepper handle renewals before they become a crisis?

The renewals pipeline tracks every tenancy against its end date and fires automated, agency-branded email notifications to both landlord and tenant at 90 days and again at 7 days before expiry. These link directly into the respective portals so both parties can act without calling the office. On the agent side, the renewals dashboard buckets every tenancy into seven states — Decision Required, Renewal In Progress, Renewal Confirmed, Renewed, Set To End, Ended, and Action Required — so the queue requiring attention is always visible at a glance. Agents can action a new fixed-term renewal, continue as periodic, or formally end the tenancy directly from the tenancy overview. If a decision date passes without action, the tenancy is automatically flagged Action Required and the responsible agent receives an alert.

How is client data protected and what compliance infrastructure is built in?

Landlord bank details and applicant personal data — including national insurance numbers, dates of birth, and income figures — are encrypted at rest using AES-256-GCM. Every mutation across the platform is captured in a tamper-evident audit log recording who did what, from which device, and when — queryable by tenancy, by user, or across the full company account. Security headers including HSTS, Content Security Policy, X-Frame-Options, and X-Content-Type-Options are enforced at the infrastructure level. Failed authentication and authorisation events are logged rather than silently dropped. For GDPR obligations, Purple Pepper provides a publicly accessible Privacy Policy, a Subject Access Request form routed to a designated DPO, and a data retention mechanism that flags records due for deletion per a defined retention schedule. AML and identity checks are handled through Blinc-UK's browser-based flow — no app download needed for applicants — with results stored against a full audit trail. Before completing a renewal, a sanctions match score drawn from UK government registers (OFSI and UKSL) is surfaced for both tenant and landlord.

We run multiple branches under one agency — can Purple Pepper handle that without siloing everything?

Yes. Multi-branch operation is a first-class feature. Each branch has its own name, address, and assigned users. Properties, tenancies, and offers are scoped to the branch they belong to, so a branch agent only sees their own workload. Managers with cross-branch access see a consolidated portfolio view across the whole company. Branch assignment is managed in Company Settings, and where applicable users can be assigned across more than one branch. Per-branch branding overrides mean each branch can present its own identity to tenants and landlords through the portal without requiring a separate company account.

[ SEC / TRUST ]

Built for an industry where a data breach isn't a PR problem — it's a legal one.

Purple Pepper handles tenants' national insurance numbers, bank details, proof of identity, and signed legal agreements. Here is exactly what we do — and don't do — to keep that data safe.

Encryption at rest

Landlord bank details and applicant PII — NI numbers, dates of birth, income figures — are stored under AES-256-GCM encryption. The fields most likely to cause harm if exposed are the first to be protected.

Secure transport

HSTS is enforced across every route. HTTP connections are refused and upgraded. Strict-Transport-Security, X-Frame-Options: DENY and X-Content-Type-Options: nosniff headers ship on every response.

Content Security Policy

A Content Security Policy header is set on every page. Inline scripts use nonces. Image sources are restricted to specific, known CDN hostnames — no wildcard remotePatterns.

[ AML / IDENTITY ]

Identity checks that leave an audit trail — not a spreadsheet.

AML and KYC checks run through the Blinc-UK API — liveness tests, AI-powered document scanning, proof of address — all browser-based, no app download required. Every check consumes one credit from an auditable ledger and records the initiating agent, timestamp, and result. Nothing is eyeballed and filed away.

Virtual, non-face-to-face identity checks via Blinc-UK
Per-check credit ledger with agent attribution
Full result history stored against the applicant record

Compliance risk register in Purple Pepper

[ AUDIT / ACCOUNTABILITY ]

Every action signed, timestamped, and immutable.

The audit log captures IP address, device, user, entity, and timestamp on every mutation — not just the headline actions. Failed authentication and authorisation events are logged explicitly, not silently dropped. Logs are paginated and filterable but never editable.

AML-CHECKIdentity check completed — 1 credit consumedjust now

AUDIT-LOGTenancy agreement re-issued — email corrected0:12s

CERT-EXPIRYGas Safety expiring in 28 days — agent alerted1:04s

CSP-HEADERContent Security Policy enforced on request2:11s

SIGN-EVENTTenant 2 signature received — status updated3:44s

SANCTIONS-SCANRenewal sanctions match: 0% — no action required4:50s

AUTH-FAILFailed sign-in attempt logged to audit trail6:02s

AML-CHECKIdentity check completed — 1 credit consumedjust now

AUDIT-LOGTenancy agreement re-issued — email corrected0:12s

CERT-EXPIRYGas Safety expiring in 28 days — agent alerted1:04s

CSP-HEADERContent Security Policy enforced on request2:11s

SIGN-EVENTTenant 2 signature received — status updated3:44s

SANCTIONS-SCANRenewal sanctions match: 0% — no action required4:50s

AUTH-FAILFailed sign-in attempt logged to audit trail6:02s

AML-CHECKIdentity check completed — 1 credit consumedjust now

AUDIT-LOGTenancy agreement re-issued — email corrected0:12s

CERT-EXPIRYGas Safety expiring in 28 days — agent alerted1:04s

CSP-HEADERContent Security Policy enforced on request2:11s

SIGN-EVENTTenant 2 signature received — status updated3:44s

SANCTIONS-SCANRenewal sanctions match: 0% — no action required4:50s

AUTH-FAILFailed sign-in attempt logged to audit trail6:02s

AML-CHECKIdentity check completed — 1 credit consumedjust now

AUDIT-LOGTenancy agreement re-issued — email corrected0:12s

CERT-EXPIRYGas Safety expiring in 28 days — agent alerted1:04s

CSP-HEADERContent Security Policy enforced on request2:11s

SIGN-EVENTTenant 2 signature received — status updated3:44s

SANCTIONS-SCANRenewal sanctions match: 0% — no action required4:50s

AUTH-FAILFailed sign-in attempt logged to audit trail6:02s

STEP 01 — AUTH
Sign-in without the DB round-trip
Middleware verifies identity via JWT cookie — no database call on every protected route load. Auth failures are logged to the audit trail immediately.
STEP 02 — ENCRYPT
PII encrypted before it reaches the row
Bank sort codes, account numbers, NI numbers, dates of birth, and income figures are encrypted with AES-256-GCM before writing to the database.
STEP 03 — AUDIT
Every mutation leaves a trace
An audit middleware intercepts every tRPC mutation. CompanyId, userId, IP address, entity type, and timestamp are written before the response returns.
STEP 04 — RATE LIMIT
Public endpoints throttled at the edge
Auth routes and all public-facing API endpoints are protected by Redis-backed rate limiting — not in-memory, so limits hold across serverless instances.

0.1sgetToken({ req, secret }) → JWT verified

0.3sprotectedProcedure → access granted

0.5sFailed attempt → audit_log.insert()

0.2sencrypt(bankSortCode, AES-256-GCM)

0.4sencrypt(nationalInsuranceNumber)

0.6sdb.insert() → ciphertext stored

0.1stRPC mutation intercepted

0.3saudit_logs.insert({ userId, ip, action })

0.5srecord immutable — no update path exists

0.2scheckRateLimit(req) → Upstash Redis

0.4sthreshold enforced across all instances

0.7s429 returned → event logged

[ DATA / CONTROLS ]

Access that stops at the branch door.

Multi-branch agencies scope every record — properties, tenancies, offers, documents — to the branch. A Weybridge agent cannot see a Cardiff branch's portfolio. Cross-branch managers see an aggregated view only when their role permits it. Role-based access (admin, agent, read-only) is enforced at the API layer, not just the UI.

Role-based access

Admin, agent, and read-only roles enforced at every tRPC procedure — not gated at the front end only.

[ GDPR / DATA RIGHTS ]

Data subject rights are a form, not a promise.

Subject Access Requests, data correction requests, and complaints escalation pathways are built into the platform — not handled by an email thread. Records due for deletion under the retention schedule are surfaced automatically. ICO registration details are published on the GDPR page.

Subject Access Requests SAR form routes directly to the DPO — no manual forwarding step.
Data correction requests Inaccurate data correction form with structured workflow built in.
Complaints escalation ICO escalation pathway disclosed and linked from the GDPR page.

[ eSIGN / DOCUMENT INTEGRITY ]

Signed means signed — and the system can prove it in court.

Document open and read events are recorded — including how many times a recipient opened the link — before any signature is collected. If a tenant never signs, a date- and time-stamped proof-of-service record is available to download as court evidence.

Open and read tracking with count logged against the tenancy record
Proof-of-service export for unsigned documents — admissible evidence trail
Visual signing status indicators: red = awaiting, green = signed, per signatory

[ FAQ / SECURITY ]

Plain answers to the questions agencies actually ask.

[ EARLY ACCESS ]

See the controls in the product, not just the page.

Join the waitlist to access Purple Pepper. If you have specific security or data handling questions before you do, email sf-core-org-support-purple-pepper@saas-factory.ai — a real person will respond.