RentGuard

The document is shown in part — the full one is in the owner’s ZIP.

Product Requirements Document (PRD)

RentGuard — Automated Tenant Screening & Verification SaaS

Document Status: Final / Approved Date: September 4, 2026 Author: Product Management & Technical Leadership Target Delivery: Q4 2026

1. Executive Summary

1.1 Vision & Problem Statement

Traditional tenant background and financial screening is broken. Property managers and landlords spend hours manually reviewing PDF bank statements, verifying pay stubs, and attempting to spot sophisticated document tampering. This manual workflow creates long leasing cycles (often taking 3–5 business days), increases tenant drop-off rates, and exposes leasing organizations to document fraud and compliance liabilities under FCRA and GDPR.

1.2 Solution Summary

RentGuard is an automated B2B SaaS tenant screening platform engineered to evaluate applicant affordability and background reliability in under 60 seconds. By combining Open Banking API integrations, direct document parsing, and real-time AI-driven metadata fraud detection, RentGuard delivers an instantaneous, standardized affordability and risk report directly into property management software (PMS) workflows or native dashboards.

1.3 Key Product Differentiators

• 60-Second Speed SLA: Complete end-to-end processing pipeline from applicant data submission to report delivery in under 60 seconds.
• 100% Automated Metadata Fraud Inspection: Zero-latency streaming analysis on every non-Open-Banking PDF bank statement to detect structural modifications, layer alterations, and software footprint anomalies.
• Open Banking Fallback Resilience: Graceful, friction-free transition from Open Banking to fallback document upload upon hitting a 2-attempt limit.
• Strict Legal & Regulatory Boundary Execution: Delivers raw financial verification indicators and standardized risk signals with mandatory disclaimers, avoiding legal reclassification as a Consumer Reporting Agency (CRA).

2. Target Audience & Personas

2.1 Target Market Segments

1. Mid-Sized Property Management Companies (50–500 doors): High leasing volume; urgent need to standardize operations and reduce time-to-lease without expanding operational headcount.
2. Residential Leasing Agencies & Brokers: Focus on closing deals quickly; highly sensitive to applicant drop-off caused by friction-heavy screening flows.
3. Co-Living & Student Housing Operators: Fast turnover environments requiring near-instant turnaround times and modern, mobile-first applicant experiences.
4. Private Portfolio Landlords (10–50 doors): Require enterprise-grade fraud detection without complex software overhead or manual document verification expertise.

2.2 User Personas

The table is wider than the screen — scroll it sideways.

3. Core Value & Core Loop

3.1 Core Value Proposition

> Instant 60-second tenant affordability and reliability verification with high-accuracy document fraud detection, eliminating manual bank statement reviews and shortening leasing cycles.

3.2 Core Operational Loop

[ Property Manager ] ---> Dispatches Tokenized Link via PMS / Dashboard
                                   |
                                   v
[ Prospective Tenant ] --> Grants Consent & Connects Open Banking OR Uploads PDFs + ID
                                   |
                                   v
[ RentGuard Pipeline ] -> Analyzes Transactions + Runs 100% Metadata Fraud Engine (< 60s)
                                   |
                                   v
[ Property Manager ] <--- Receives Standardized Affordability & Risk Report

1. Dispatch: Property Manager triggers a verification request via PMS plugin or RentGuard Dashboard, sending a tokenized link via SMS/Email to the applicant.
2. Data Ingestion: Applicant opens the mobile-optimized web flow, provides explicit GDPR/FCRA consent, and either connects their financial institution via Open Banking or uploads PDF statements and ID.
3. Automated Analysis: RentGuard executes transaction categorization, income verification, affordability calculations, and 100% PDF metadata tampering analysis within a 60-second execution window.
4. Report Delivery: RentGuard pushes a standardized risk and affordability report back to the PM's dashboard and PMS webhook, enabling immediate lease decision-making.

3.3 System Invariants & Non-Negotiables

To maintain operational integrity, strict legal compliance, and technical predictability, all product implementations must adhere to the following invariants:

• INV-01 (Data Encryption & Privacy): All applicant PII and banking data must be encrypted at rest (AES-256) and in transit (TLS 1.3) in strict compliance with GDPR and FCRA standards.
• INV-02 (Processing Performance): Document fraud analysis, transaction parsing, and final report rendering must yield a completed output within 60 seconds of data submission.
• INV-03 (Zero Data Resale): Applicant data must never be sold, re-purposed, aggregated for external commercial models, or shared with third parties without explicit, revocable consent.
• INV-04 (100% PDF Metadata Audit): Metadata tampering and structural anomaly detection must run on 100% of uploaded non-Open-Banking PDF statements without exception.
• INV-05 (Open Banking Attempt Cap): A maximum of 2 Open Banking connection attempts is permitted per applicant transaction token to prevent aggregator cost overruns.
• INV-06 (Raw Verification Indicators & Legal Boundary): Outputs must strictly present raw financial verification indicators, objective metrics, and disclaimers. The platform must refrain from issuing automated legal adverse decisions or binary pass/fail instructions.

4. Detailed Feature Scope

4.1 Functional Requirements & Feature Prioritization

The table is wider than the screen — scroll it sideways.

4.2 Detailed User Journey & Screen Requirements

+-----------------------------------------------------------------------------------+
| USER JOURNEY FLOW                                                                 |
|                                                                                   |
|  [Step 1: Invite] ---> [Step 2: Consent] ---> [Step 3: Connect/Upload]            |
|                                                        |                          |
|  [Step 5: Report]  <--- [Step 4: Real-Time Engine] <----+                         |
+-----------------------------------------------------------------------------------+

Step 1: Invitation Dispatch

• Trigger: PM selects "New Verification" in Dashboard or triggers via PMS workflow.
• Interface (PMS / Dashboard Panel): Input fields for Applicant Name, Email, Phone Number, Target Monthly Rent, and Property ID.
• Action: System generates a secure, tokenized invitation link sent via SMS and Email.

Step 2: Applicant Authorization

• Interface (Applicant Onboarding Screen): Mobile-first, branded UI introducing RentGuard security protocols.
• Content: Transparent data usage summary, privacy policy link, and mandatory checkboxes for FCRA and GDPR explicit consent.
• Action: Applicant clicks "Accept & Continue". Timestamp and IP are logged for audit compliance.

Step 3: Financial & ID Connection Flow

• Interface (Dual Connection Interface):
• Primary Action: "Instant Bank Connect" (Open Banking flow via Plaid/TruLayer).
• Secondary Action: "Upload Bank Statements (PDF)".
• Logic Rules:
• If Open Banking is selected, applicant enters credentials via embedded secure iframe.
• If connection fails twice, the system disables the OB option and automatically transitions the applicant to PDF upload.
• If PDF is selected, applicant drops 3 consecutive months of statements alongside a photoshot of a photo ID.

+-----------------------------------------------------------------------------------+
| SCREEN: Financial Data Connection Flow                                            |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [ SECURE BANK CONNECT ] (Recommended)                                            |
|  Connect instantly via your bank. Fast, encrypted, 100% accurate.                 |
|  [ Connect Bank Account ]  <-- Attempt 1/2                                        |
|                                                                                   |
|  ---------------------------------- OR ----------------------------------        |
|                                                                                   |
|  [ UPLOAD BANK STATEMENTS ]                                                       |
|  Drag and drop 3 months of official PDF bank statements.                          |
|  +-----------------------------------------------------------------------------+  |
|  | [Icon] Drop PDF statements here or click to browse                          |  |
|  +-----------------------------------------------------------------------------+  |
|                                                                                   |
+-----------------------------------------------------------------------------------+

Step 4: Automated Verification (Real-Time Processing)

• Interface (60-Second Real-Time Processing Screen): Animated feedback interface displaying progress steps:

1. Analyzing Document Metadata & Structure...
2. Extracting Transaction Histories & Income Streams...
3. Calculating Affordability & Cash Flow Metrics...
4. Finalizing Verification Report...

• Technical Action: Parallel pipeline runs metadata checks, OCR parsing, transaction classification, and income calculations.

Step 5: Report Delivery & Review

• Interface (Standardized Affordability & Risk Report View):
• Header: Summary metrics (Verified Monthly Income, Calculated Rent-to-Income %, Average Monthly Balance).
• Risk & Integrity Flags: High-visibility indicators (e.g., PDF Metadata Integrity: VERIFIED or Document Tampering Flagged: MODIFIED_LAYERS_DETECTED).
• Financial Breakdown: Categorized recurring income, expense obligations, NSF count, and cash flow trends.
• Footer Legal Disclaimer: Non-adverse action statement detailing that this report represents raw factual data and does not constitute a legal rental decision or CRA score.

4.3 Latency-Critical Interactions & Technical SLAs

The table is wider than the screen — scroll it sideways.

4.4 Error Handling & Fallback Flows

+-----------------------------------------------------------------------------------+
| ERROR HANDLING MATRIX                                                             |
+-----------------------------------------------------------------------------------+
| Event                        | Immediate Action         | User/System Resolution  |
+------------------------------+--------------------------+-------------------------+
| Open Banking Failed (Attempt 2)| Block OB Module          | Auto-fallback to PDF    |
| PDF Metadata Modified        | Continue Report Assembly | Flag "Tampering Detected"|
| Encrypted / Password PDF     | Reject File Upload       | Prompt for Unlocked PDF |
| Expired Transaction Token    | Block Access             | Render Re-issuance Link |
+-----------------------------------------------------------------------------------+

1. Open Banking Attempt Limit Exceeded:

• Trigger: Applicant encounters 2 consecutive connection or authentication failures with their financial institution.
• System Action: The system displays a soft error banner ("Bank connection timed out") and automatically locks the Open Banking portal, transitioning the UI directly to the PDF Statement Dropzone.

1. Document Tampering Detected:

• Trigger: Structural metadata scanning detects altered PDF authoring streams, mismatched fonts, or modified text elements.
• System Action: The processing engine does not crash or abort. It completes the report assembly but applies a prominent warning badge: Document Integrity Flag: Alterations Detected with a granular metadata log attached for PM inspection.

1. Corrupted or Password-Protected Uploads:

• Trigger: Client-side file drop of an encrypted, password-protected, or malformed PDF file.
• System Action: Immediate client-side validation rejects the file prior to cloud upload, raising an inline error: "Uploaded PDF is password-protected or unreadable. Please upload an unlocked file."

1. Expired Transaction Token:

• Trigger: Applicant accesses verification link after the 72-hour expiration window.
• System Action: Displays a clean, action-oriented landing page informing the applicant that the link has expired, providing a one-click button to request an automated link re-issuance from the PM.

5. Explicit Non-Goals

To maintain operational focus, prevent feature creep, and protect against regulatory misclassification, the following capabilities are explicitly out of scope for RentGuard:

1. Lease Orchestration & Document Signing: RentGuard will not provide lease contract generation, digital signatures (e.g., DocuSign clone), or lease lifecycle execution.
2. All-in-One Property Management Systems (PMS): RentGuard will not build listing syndication, tenant communication portals, maintenance ticketing, or unit inventory tools.
3. Primary Credit Bureau / CRA Operations: RentGuard will not issue traditional credit bureau scores (e.g., FICO, VantageScore), pull hard/soft credit bureau files directly, or resell tri-bureau credit reports.
4. Rent Collection & Escrow Processing: RentGuard will not handle ongoing monthly rent ACH payments, security deposit escrow holding, or payment gateway processing.
5. Human-in-the-Loop Fallback Verification: RentGuard will not operate a manual human auditing desk, document call centers, or manual document verification teams. All checks must be 100% automated.
6. Custom Configurable Underwriting Engines: RentGuard will not allow individual clients to write custom code or arbitrary proprietary scoring algorithms within the core engine. All clients utilize standardized risk and affordability indicators.

6. Success Metrics & KPIs

The table is wider than the screen — scroll it sideways.

7. Risks & Mitigations

7.1 Legal, Technical, and Financial Risk Matrix

+-----------------------------------------------------------------------------------+
| RISK MATRIX                                                                       |

The document is shown in part — the full one is in the owner’s ZIP.

ARCHITECTURE.md — RentGuard Tenant Screening Platform

System Architecture & Technical Specification Blueprint Project: RentGuard Architectural Pattern: Modular Monolith with Asynchronous Task Queue Worker Pipeline Target Environment: B2B Micro-SaaS / PMS Integrations / Web Application

1. Executive Summary & System Overview

RentGuard is an enterprise-grade tenant screening Micro-SaaS engine engineered for instant Open Banking income verification, PDF document fraud detection, and automated financial scoring. It provides property management companies (PMCs) and landlords with immediate risk verification reports while maintaining zero operational overhead from human-in-the-loop manual review desks.

+-----------------------------------------------------------------------------------+
|                                  RENTGUARD EDGE                                   |
|                                                                                   |
|   +-------------------+       +-----------------------+       +---------------+   |
|   |  React 18 / Vite  |  <--  | REST API / WebSockets |  -->  |  PMS Plugins  |   |
|   |   Tailwind UI     |       |       (TLS 1.3)       |       |  (Partner)    |   |
|   +-------------------+       +-----------------------+       +---------------+   |
+-------------------------------------------|---------------------------------------+
                                            |
                                            v
+-----------------------------------------------------------------------------------+
|                           MODULAR MONOLITH APPLICATION                            |
|                                                                                   |
|   +---------------------------------------------------------------------------+   |
|   |                            FastAPI Application                            |   |
|   |                                                                           |   |
|   |  +--------------------+  +----------------------+  +-------------------+  |   |
|   |  | Sessions Endpoints |  |  Reports Endpoints   |  | Core Auth & PII   |  |   |
|   |  +--------------------+  +----------------------+  +-------------------+  |   |
|   +-------------------------------------|-------------------------------------+   |
|                                         |                                         |
|                                         v                                         |
|   +---------------------------------------------------------------------------+   |
|   |                        SQLite Core Data Engine                            |   |
|   |             SQLModel (SQLAlchemy 2.0 + Pydantic v2) / WAL Mode            |   |
|   +---------------------------------------------------------------------------+   |
+-----------------------------------------|-----------------------------------------+
                                          |
                      +-------------------+-------------------+
                      | (Async Broker)                        | (Async Tasks)
                      v                                       v
          +-----------------------+               +-----------------------+
          |      Redis 7.x        |               |   Celery Workers      |
          |  (Queue / PubSub WS)  |               |  (3-Stage Pipeline)   |
          +-----------------------+               +-----------------------+
                                                              |
                                      +-----------------------+-----------------------+
                                      |                       |                       |
                                      v                       v                       v
                          +-------------------+   +-------------------+   +---------------+
                          | PDF Fraud Engine  |   | Open Banking Sync |   | Scoring Engine|
                          | (100% Inspection) |   | (Max 2 Attempts)  |   | (Non-Adverse) |
                          +-------------------+   +-------------------+   +---------------+

Key Architectural Invariants & Guarantees

1. Sub-2000ms Synchronous API Latency: All HTTP synchronous requests complete in $\le 2000\text{ ms}$.
2. 60-Second Async Scoring SLA: Asynchronous tasks (PDF Metadata Fraud Analysis, OCR extraction, and Financial Scoring Pipeline) return a finished report within 60 seconds from the time of submission.
3. 100% PDF Tampering Analysis: Every uploaded non-Open-Banking PDF bank statement undergoes deep structure inspection, metadata validation, font table parsing, and incremental update checks.
4. Hard-Capped Open Banking Connections: Strictly enforced limit of maximum 2 Open Banking connection attempts per transaction token to eliminate API overruns and retry loops.
5. Non-Adverse Legal Decision Disclaimer: All scoring reports output objective financial indicators, affordability metrics, and risk flags without delivering automated legal lease rejections or adverse action commands.
6. Zero-Trust Encrypted Storage: All applicant Personally Identifiable Information (PII) and raw banking data are encrypted at rest via AES-256-GCM and in transit via TLS 1.3.

Explicit System Non-Goals

• No Lease Orchestration: RentGuard does not handle lease agreement generation, digital signing workflows, or security deposit management.
• No All-in-One PMS: RentGuard is strictly a screening engine and does not provide listing engine capabilities, maintenance ticketing, or full tenant management platforms.
• No Credit Bureau Reseller Operations: RentGuard is not a licensed primary credit bureau and does not pull or resell credit scores.
• No Rent Collection / Escrow: RentGuard does not process ongoing rent payments, maintain client escrow accounts, or handle ledger balancing.
• No Manual Fallback Operations: RentGuard does not operate manual verification desks or human audit services. Verification is 100% automated.
• No Custom Per-Client Underwriting Logic: RentGuard does not offer customizable risk scoring logic or rule customization engines per tenant.

2. Component Architecture & System Boundaries

componentDiagram
    title RentGuard Modular Monolith & System Architecture

    package "Client Layer" {
        [React 18 Frontend] as UI
        [PMS Plugin Integration] as PMS
    }

    package "Monolith Backend (FastAPI)" {
        [API Gateway / Router] as Router
        [Auth & Security Module] as Auth
        [Session Domain Module] as SessionMod
        [Report Domain Module] as ReportMod
        [SQLModel Engine Engine (SQLite WAL)] as DB
    }

    package "Asynchronous Queue & Workers" {
        [Redis Broker & State] as Redis
        [Celery Worker Cluster] as Celery
        [PDF Fraud Detector Service] as FraudEngine
        [Open Banking Service] as OBEngine
        [Financial Scoring Engine] as ScoringEngine
    }

    UI --> Router : HTTPS REST / WebSockets
    PMS --> Router : HTTPS REST (API Keys)
    
    Router --> Auth : Authenticate / Decrypt Token
    Router --> SessionMod : Manage Verification State
    Router --> ReportMod : Fetch Completed Reports
    
    SessionMod --> DB : Read / Write Session & PII
    ReportMod --> DB : Read Immutable Reports

    SessionMod --> Redis : Dispatch Async Tasks / Notify WS
    Redis --> Celery : Consume Tasks
    
    Celery --> FraudEngine : Execute Metadata & OCR Verification
    Celery --> OBEngine : Execute OAuth Sync (Limit: 2)
    Celery --> ScoringEngine : Compute Indicators & Disclaimers
    
    ScoringEngine --> DB : Persist Immutable FinancialReport
    Celery --> Redis : Broadcast Status via WebSockets

Monolith Subsystem Division

1. API Router & Web Framework (FastAPI / Python 3.12):

• Handles request validation via Pydantic v2.
• Manages low-latency synchronous routes ($<2000\text{ ms}$).
• Pushes long-running operations directly to the Redis task broker.

1. Data Storage Layer (SQLite in WAL Mode + SQLModel):

• Runs SQLite in Write-Ahead Logging (WAL) mode to achieve concurrent reads and atomic writes without database lock contention.
• SQLModel bridges SQLAlchemy 2.0 ORM features with Pydantic v2 schemas.

1. Task Orchestration (Celery + Redis):

• Offloads OCR, PDF structural analysis, Open Banking syncing, and scoring matrix evaluation.
• Leverages Redis Pub/Sub to push real-time WebSocket updates to the React client interface.

1. Domain Services:

• PDFFraudDetector: Executes PDF parser checks (looking for mod dates, font anomalies, structure inconsistencies, and editing software stamps like Adobe Acrobat/Canva).
• OpenBankingConnector: Manages OAuth state tokens and strictly bounds sync attempts to 2 per transaction.
• ScoringEngine: Computes average monthly net income, cash-flow volatility, recurring debt obligations, and rent-to-income coverage ratios.

3. Data Architecture & Schema Models

Entity-Relationship Diagram

erDiagram
    ORGANIZATION ||--o{ USER : employs
    ORGANIZATION ||--o{ APPLICANT : screens
    APPLICANT ||--o{ VERIFICATION_SESSION : initiates
    VERIFICATION_SESSION ||--o| FINANCIAL_REPORT : produces

    ORGANIZATION {
        uuid id PK
        string name
        string api_key_hash
        datetime created_at
    }

    USER {
        uuid id PK
        uuid organization_id FK
        string email
        string password_hash
        string role
        datetime created_at
    }

    APPLICANT {
        uuid id PK
        uuid organization_id FK
        bytes encrypted_pii
        string email_hash
        boolean consent_given
        datetime consent_timestamp
    }

    VERIFICATION_SESSION {
        uuid id PK
        string token UK
        uuid applicant_id FK
        string status
        integer open_banking_attempts
        json uploaded_documents_meta
        datetime expires_at
        datetime created_at
    }

    FINANCIAL_REPORT {
        uuid id PK
        uuid verification_session_id FK
        float net_monthly_income
        float rent_to_income_ratio
        integer tampering_flags_count
        json indicators_payload
        string legal_disclaimer
        datetime generated_at
    }

4. Source Code Implementations

4.1. Domain Data Models (rentguard-backend/app/models/domain.py)

"""
Domain Data Models for RentGuard Screening Platform
Engineered with SQLModel (SQLAlchemy 2.0 + Pydantic v2)
"""

import uuid
from datetime import datetime, timezone
from typing import Optional, List, Dict, Any
from sqlmodel import SQLModel, Field, Relationship, JSON, Column
from sqlalchemy import LargeBinary


class Organization(SQLModel, table=True):
    __tablename__: str = "organizations"

    id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
    name: str = Field(index=True)
    api_key_hash: str = Field(unique=True, index=True)
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    # Relationships
    users: List["User"] = Relationship(back_populates="organization")
    applicants: List["Applicant"] = Relationship(back_populates="organization")


class User(SQLModel, table=True):
    __tablename__: str = "users"

    id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
    organization_id: uuid.UUID = Field(foreign_key="organizations.id", index=True)
    email: str = Field(unique=True, index=True)
    password_hash: str
    role: str = Field(default="property_manager")
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    # Relationships
    organization: Optional[Organization] = Relationship(back_populates="users")


class Applicant(SQLModel, table=True):
    __tablename__: str = "applicants"

    id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
    organization_id: uuid.UUID = Field(foreign_key="organizations.id", index=True)
    
    # Encrypted PII (Name, SSN/National ID, Phone) stored as encrypted AES-256-GCM binary byte array
    encrypted_pii: bytes = Field(sa_column=Column(LargeBinary, nullable=False))
    email_hash: str = Field(index=True)  # Deterministic hash for lookups without decrypting
    
    consent_given: bool = Field(default=False)
    consent_timestamp: Optional[datetime] = Field(default=None)
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    # Relationships
    organization: Optional[Organization] = Relationship(back_populates="applicants")
    sessions: List["VerificationSession"] = Relationship(back_populates="applicant")


class VerificationSession(SQLModel, table=True):
    __tablename__: str = "verification_sessions"

    id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
    token: str = Field(unique=True, index=True)
    applicant_id: uuid.UUID = Field(foreign_key="applicants.id", index=True)
    
    status: str = Field(default="pending", index=True)  # pending, processing, completed, failed
    open_banking_attempts: int = Field(default=0)  # HARD INVARIANT: Max 2 attempts
    uploaded_documents_meta: Dict[str, Any] = Field(default_factory=dict, sa_column=Column(JSON))
    
    expires_at: datetime
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    # Relationships
    applicant: Optional[Applicant] = Relationship(back_populates="sessions")
    financial_report: Optional["FinancialReport"] = Relationship(
        back_populates="verification_session", sa_relationship_kwargs={"uselist": False}
    )


class FinancialReport(SQLModel, table=True):
    __tablename__: str = "financial_reports"

    id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
    verification_session_id: uuid.UUID = Field(
        foreign_key="verification_sessions.id", unique=True, index=True
    )
    
    net_monthly_income: float
    rent_to_income_ratio: float
    tampering_flags_count: int
    indicators_payload: Dict[str, Any] = Field(default_factory=dict, sa_column=Column(JSON))
    
    # Required FCRA/GDPR non-adverse legal disclaimer string
    legal_disclaimer: str = Field(
        default=(
            "DISCLAIMER: This report provides raw financial verification indicators and automated "
            "tampering analysis only. RentGuard does not issue consumer credit scores, nor does it "
            "make automated adverse leasing decisions. Property managers must independently evaluate "
            "this document in compliance with applicable local fair housing standards."
        )
    )
    generated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    # Relationships
    verification_session: Optional[VerificationSession] = Relationship(back_populates="financial_report")

4.2. PDF Fraud & Metadata Inspector (rentguard-backend/app/services/pdf_fraud_detector.py)

"""
PDF Fraud Detector Engine
Analyzes 100% of non-Open-Banking uploaded bank statements for metadata manipulation,
font inconsistencies, software modification stamps, and stream anomalies.
"""

import io
from typing import Dict, Any, List
from pypdf import PdfReader


class PDFFraudDetector:
    SUSPECT_CREATORS = [
        "canva", "photoshop", "illustrator", "inkscape", "gimp", 
        "pdfescape", "smallpdf", "sejda", "iLovePDF"
    ]

    def analyze_pdf_stream(self, file_bytes: bytes) -> Dict[str, Any]:
        """
        Executes structural integrity checks on raw PDF byte stream.
        """
        reader = PdfReader(io.BytesIO(file_bytes))
        metadata = reader.metadata or {}
        
        flags: List[str] = []
        is_tampered = False

        # 1. Inspect Producer and Creator metadata flags
        producer = str(metadata.get("/Producer", "")).lower()
        creator = str(metadata.get("/Creator", "")).lower()

        for tool in self.SUSPECT_CREATORS:
            if tool in producer or tool in creator:
                flags.append(f"SUSPICIOUS_CREATOR_TOOL: Document created/edited using '{tool}'.")
                is_tampered = True

        # 2. Inspect CreationDate vs ModDate discrepancy
        creation_date = metadata.get("/CreationDate")
        mod_date = metadata.get("/ModDate")

        if creation_date and mod_date and creation_date != mod_date:
            flags.append(
                f"MODIFICATION_DATE_MISMATCH: CreationDate ({creation_date}) differs "
                f"from ModDate ({mod_date}). Document was modified post-generation."
            )
            is_tampered = True

        # 3. Analyze Font Consistency & Embedded Subsets
        font_names = set()
        for page in reader.pages:
            if "/Resources" in page and "/Font" in page["/Resources"]:
                fonts = page["/Resources"]["/Font"]
                if hasattr(fonts, "keys"):
                    for font_key in fonts.keys():
                        font_obj = fonts[font_key]
                        if hasattr(font_obj, "get") and font_obj.get("/BaseFont"):
                            font_names.add(str(font_obj.get("/BaseFont")))

        # Statements edited with basic PDF editors often inject non-standard system fonts (e.g. Arial/Calibri on standard bank templates)
        if len(font_names) > 12:
            flags.append(f"HIGH_FONT_VARIANCE: Detected {len(font_names)} distinct fonts in bank statement.")
            is_tampered = True

        # 4. Stream Analysis (XRef & Incremental Updates)
        # Multiple updates indicate post-export text modifications
        raw_content = file_bytes.decode("latin-1", errors="ignore")
        xref_count = raw_content.count("startxref")
        if xref_count > 1:
            flags.append(f"MULTIPLE_INCREMENTAL_UPDATES: Found {xref_count} startxref tokens indicating manual edits.")
            is_tampered = True

        return {
            "is_tampered": is_tampered,
            "flags_count": len(flags),
            "flags": flags,
            "metadata_summary": {
                "producer": producer,
                "creator": creator,
                "page_count": len(reader.pages),
                "detected_fonts_count": len(font_names)
            }
        }

4.3. Session Controller Endpoints (rentguard-backend/app/api/v1/endpoints/sessions.py)

"""
API Endpoints for Session Token Lifecycle & Open Banking Connections.
Enforces Maximum 2 Open Banking Attempts and <2000ms Latency SLA.
"""

from datetime import datetime, timedelta, timezone
import secrets
from typing import Any
from fastapi import APIRouter, Depends, HTTPException, Status, UploadFile, File
from sqlmodel import Session, select

from app.models.domain import VerificationSession, Applicant, FinancialReport
from app.services.pdf_fraud_detector import PDFFraudDetector

router = APIRouter(prefix="/sessions", tags=["Verification Sessions"])

# Mock DB Session Dependency
def get_db():
    pass

@router.post("", status_code=Status.HTTP_201_CREATED)
def create_verification_session(
    applicant_id: str,
    db: Session = Depends(get_db)
) -> Any:
    """
    Creates a new tenant verification session token for an applicant.
    Latency SLA: < 200ms
    """
    token = f"rg_live_{secrets.token_urlsafe(32)}"
    expires_at = datetime.now(timezone.utc) + timedelta(hours=24)

    session = VerificationSession(
        token=token,
        applicant_id=applicant_id,
        status="pending",
        open_banking_attempts=0,
        expires_at=expires_at
    )
    # Save to SQLite WAL database
    # db.add(session); db.commit(); db.refresh(session)
    return {
        "status": "success",
        "verification_token": token,

Consilium decision log — RentGuard

What the Devil's Advocate challenged and what the Arbiter decided. Every risk got a verdict; the boundaries below are the outcome of the debate, not the first draft.

Non-Goals proposed by the strategist

• Building a full lease orchestration or contract signing platform.
• Operating as an all-in-one property management software (PMS) or listing engine.
• Acting as a licensed primary credit bureau or issuing credit scores directly.
• Handling ongoing rent collection, escrow, or payment processing.

Non-Goals after arbitration

• Building a full lease orchestration, contract signing, or deposit collection platform.
• Operating as an all-in-one property management software (PMS) or listing engine.
• Acting as a licensed primary credit bureau or issuing direct credit bureau scores / reseller reports.
• Handling ongoing rent collection, escrow, or payment processing.
• Providing human-in-the-loop manual fallback verification desks or human audit services.
• Developing custom configurable underwriting engines or custom risk scoring logic per client.

Added by the arbiter:

• Building a full lease orchestration, contract signing, or deposit collection platform.
• Acting as a licensed primary credit bureau or issuing direct credit bureau scores / reseller reports.
• Providing human-in-the-loop manual fallback verification desks or human audit services.
• Developing custom configurable underwriting engines or custom risk scoring logic per client.

Dropped by the arbiter:

• Building a full lease orchestration or contract signing platform.
• Acting as a licensed primary credit bureau or issuing credit scores directly.

Risk decisions

| # | risk | decision | action | | - | - | - | - | | 1 | FCRA / CRA Legal Reclassification Exposure | mitigated (invariant added) | Hard-code explicit disclaimers stating outputs are transaction analytics only and enforce non-decisioning report formats. | | 2 | Open Banking Conversion Collapse | accepted (scope changed) | Support structured PDF statement uploading as a seamless fallback while highlighting open banking approval speed benefits. | | 3 | PDF Fraud Detection Vulnerability | mitigated (invariant added) | Combine metadata verification with OCR-raster image analysis and automatically flag tampered documents for re-upload. | | 4 | Open Banking API Cost Squeeze | mitigated (invariant added) | Enforce a hard rate-limit of 2 Open Banking connection attempts per paid applicant session token. | | 5 | Integration of Traditional Credit Bureau Pulls | rejected | Keep credit bureau reselling strictly out of scope to avoid CRA liabilities and focus entirely on open banking analytics. | | 6 | Custom Risk Rule Engine | rejected | Maintain standardized affordability and verification metrics without custom underwriting rule engines. | | 7 | Lease Signing and Workflow Automation | rejected | Explicitly place lease contract generation, e-signatures, and deposit handling into Non-Goals. | | 8 | Manual Fallback Verification Desk | rejected | Reject human-in-the-loop manual review operations to remain a pure zero-operational-overhead software platform. |

Arbiter's rationale: RentGuard solves a critical pain point in tenant fraud detection with low sales complexity and strong willingness to pay. By enforcing hard boundaries against manual review desks, credit bureau pulls, and custom rule engines, the company preserves its high-margin Micro-SaaS economics while maintaining a sub-2000ms latency standard.

Disagreement level: 0.35