Contact Us

Work Case study · Web application

Fourteen buildings, one portal instead of forty WhatsApp groups

A property management company ran rent, repairs and owner reports through WhatsApp groups and spreadsheets. We built a secure web application for tenants, technicians, managers and owners, designed to security standards from the first line of code.

Where they started

A business run from group chats

The company manages fourteen apartment buildings between Colombo 05 and Mount Lavinia for overseas and local owners. Each building had its own WhatsApp group. A leaking pipe was a photo in a chat, a technician’s reply was a thumbs-up, and whether it was ever fixed lived in someone’s memory.

Rent was tracked in a spreadsheet updated from bank slips. Owners abroad asked for statements by email and waited days. And because tenants’ ID copies, lease agreements and payment details were scattered across phones and inboxes, the company had no clear answer to a simple question: who can see what?

Client
Property management company, Colombo (name withheld)
Scale
14 buildings, about 520 units
Users
Tenants, technicians, managers, owners
Timeline
5 months, in three releases
A property manager working on a tablet by an office window

01 The portal

Every repair has an owner and a clock

Tenants report a problem from their phone with a photo, and get a ticket number. Managers assign it to a technician, who updates it from site. Everyone sees the same status, and nothing sits unanswered: tickets that pass their target time are escalated automatically.

Rent, service charges and receipts live in the same place. Tenants pay online or upload a slip; owners abroad download monthly statements whenever they like. We tested each release with real tenants and fixed what confused them; the final version scored 84 on the System Usability Scale, well above the typical average1.

portal.property-co.example/maintenance
MaintenanceHavelock Towers · 38 units

New · 2

Leaking kitchen tapUnit 7B · photo attached
Due today
Lift button stuckLobby · reported 08:12
Urgent

In progress · 2

AC not coolingUnit 12A · Ruwan, on site
On time
Water pressure lowFloors 9–11 · pump check
Due 4 pm

Done · 14

Door lock replacedUnit 3C · closed in 1.5 days
Corridor lightFloor 6 · closed in 4 h

Ticket #4417 · Leaking tap, Unit 7B · closed in 26 hours

Security

Built to standards, not to hope

The portal holds leases, ID copies and payment records, so security was designed in, not bolted on. We built and tested it against the OWASP Application Security Verification Standard2, and checked it against the OWASP Top 10 risks for web applications3.

  • Everyone sees only what they should. Tenants see their unit, technicians their tickets, owners their properties. Access is checked on the server for every request.
  • Two-step sign-in for staff. Managers and accountants confirm sign-in with a second factor, which research at Google found stops nearly all automated and bulk-phishing account takeovers4.
  • Modern password rules. Long passphrases, checks against known breached passwords, and no forced monthly changes, following NIST’s digital identity guidelines5.
  • A record of who did what. Every change to rent, leases and access is logged, so questions have answers.
  • Personal data handled lawfully. Tenants’ data is collected for a stated purpose, kept only as long as needed, and processed in line with Sri Lanka’s Personal Data Protection Act6.
  • Encrypted everywhere. Data is encrypted in transit and at rest, with daily backups tested by restoring them.

Results

A year on

  • 2.1 days

    To close a repair

    Down from 6.2 days, with every ticket tracked from photo to sign-off.

  • −46%

    Rent arrears

    Automatic reminders and easy online payment brought late rent down by almost half.

  • −60%

    Admin hours

    No more chasing slips, compiling statements or scrolling through group chats.

  • 40 → 0

    WhatsApp groups

    Every building’s requests now live in one place with a full history.

References

The research behind it

Every method on this page builds on published research, standards or official documentation. Numbers in the text point here.

  1. Bangor, A., Kortum, P. T., & Miller, J. T. (2008). An empirical evaluation of the System Usability Scale. International Journal of Human–Computer Interaction, 24(6), 574–594. doi.org/10.1080/10447310802205776
  2. OWASP. Application Security Verification Standard (ASVS) 5.0.0. asvs.owasp.org/
  3. OWASP. (2025). OWASP Top 10:2025. top10.owasp.org/
  4. Doerfler, P., Thomas, K., Marincenko, M., Ranieri, J., et al. (2019). Evaluating login challenges as a defense against account takeover. The World Wide Web Conference (WWW ’19), 372–382. doi.org/10.1145/3308558.3313481
  5. Temoshok, D., Fenton, J., Choong, Y.-Y., Lefkovitz, N., et al. (2025). NIST SP 800-63B-4: Digital identity guidelines, authentication and authenticator management. National Institute of Standards and Technology. doi.org/10.6028/NIST.SP.800-63b-4
  6. Parliament of Sri Lanka. (2022). Personal Data Protection Act, No. 9 of 2022 (as amended). www.dpa.gov.lk/guidelines.php

Running your business on group chats?

Tell us how the work flows today. The first conversation about a web application is free.

Talk to us Next case study