Client Work · Property Management / Fintech
Executive Storage Suites
Unit management, leasing, and recurring payment processing
executivestoragesuites.com →18
API controllers
3
regulated integrations
0
card numbers stored
.NET 10
current runtime
The Problem
Running a storage facility means inventory, leases, money, and chasing people, and each of those lived somewhere different. Availability was tracked separately from who had actually signed, leases were printed and scanned, rent was collected by hand, and a late payment was noticed when someone happened to look. Every one of those is a workflow where being wrong has a direct financial or legal cost.
The Approach
- 1
Treat money-touching code as the part that has to be right every time. Payments run through Authorize.Net with stored payment tokens: the system holds a gateway token, never a card number, which keeps the PCI surface as small as the design allows.
- 2
Close the loop on leasing rather than stopping at a PDF. DocuSign envelopes are created, sent, and tracked, and inbound webhooks move the tenancy forward on signature, so a signed lease updates the system instead of sitting in an inbox.
- 3
Make notification a compliant feature, not a convenience. SMS carries explicit consent status, templates, an outbound queue, and inbound webhook handling, because unsolicited messaging to tenants is a legal problem, not a UX problem.
- 4
Run scheduled work outside the request path. Recurring billing, queued email, and queued SMS are Azure Functions on timers, so nothing money-related depends on somebody having a browser tab open.
What It Does
- Facility, section, and unit hierarchy with unit types, statuses, and maintenance tracking
- Reservation and tenancy records with a logged reservation history
- DocuSign lease e-signature, with envelope status tracked through webhooks
- Recurring subscription billing and autopay via Authorize.Net, using stored payment tokens
- Payment logging and pending-approval handling for transactions that need review
- Waitlist management with offers and offer expiry, so a freed unit is filled in order
- Twilio SMS with per-tenant consent status, templated messages, delivery queue, and inbound reply handling
- Broadcast email and SMS to filtered tenant segments
- Public contact form with server-side spam scoring
Engineering Decisions
The choices worth defending in a technical conversation, and why they were made.
Tokenized payments, minimal PCI surface
Card data is exchanged for a gateway token and the token is what the system stores. This is the difference between a compliance conversation about scope and a compliance conversation about a breach.
Webhooks as a first-class inbound path
DocuSign and Twilio both talk back. Both have dedicated, separately secured webhook controllers rather than being bolted onto the main API surface, because an endpoint a third party can call is a different threat model from one your own SPA calls.
Consent modelled explicitly
SMS consent is a tracked status with its own lifecycle, not a boolean set at signup. Messaging regulation cares about when consent was given and when it was withdrawn, and a boolean cannot answer either question.
Secrets in Key Vault, not configuration
Gateway credentials, DocuSign keys, and Twilio tokens resolve from Azure Key Vault through the configuration provider. A payment credential in an appsettings file is a credential in source control eventually.
The Stack
Backend
Payments & documents
Messaging
Platform
Want something like this built?
Let's talk about what you're building and how we can help.