Parapet

Parapet is a done-for-you vendor insurance-compliance SaaS for property managers, and the first product I designed, built, and shipped to production entirely on my own — from the database schema and API up through the UI, deployment, and go-to-market surface. Property managers are legally on the hook for their vendors' insurance but have no time to police it; Parapet loads the certificates, reads and checks each one against the right property entity, and chases every renewal, so the portfolio stays compliant without the manager operating a tool.

The backend is a FastAPI modular monolith in Python with async SQLAlchemy 2.0, Alembic migrations, and PostgreSQL, plus an arq worker on Redis that runs the reminders, daily compliance re-checks, and scheduled jobs. Because a single missed org filter in a multi-tenant app is a cross-customer data breach, I enforced tenant isolation automatically with defense in depth — a request-scoped context variable, a SQLAlchemy query-execution hook that injects the organization filter on every tenant-scoped read, explicit repository parameters, and a CI guard that fails the build if a tenant query runs without an active org context.

The heart of the product is document extraction. Rather than an OCR-plus-mapper pipeline, extraction is a single Claude call with the PDF attached, returning structured ACORD 25 JSON with per-field confidence. That decision cut per-certificate cost by roughly 5x, deleted an entire AWS dependency from the stack, and is guarded by an accuracy corpus harness so the extractor is measured against real fixtures, not assumed to work. Low-confidence results fall to a human-in-the-loop review station before anything is trusted on the record.

The frontend is a React + TypeScript SPA built with Vite and Tailwind, using TanStack Query, React Hook Form, and Zod. The whole system is live: the API and worker run on Railway, the SPA on Vercel, behind Cloudflare DNS, with transactional email over AWS SES and Stripe wired in for billing. Beyond the code, I wrote the technical specification, ~18 architecture decision records, runbooks, and the production-readiness and business reviews — practicing the full arc of taking a product from an idea to something a real customer can pay for.

• Designed, built, and deployed a live multi-tenant SaaS solo — backend, frontend, infrastructure, and product docs.
• Built a FastAPI + async SQLAlchemy 2.0 modular monolith on PostgreSQL with an arq/Redis worker for reminders and scheduled compliance jobs.
• Enforced automatic tenant isolation with defense in depth (request context, SQLAlchemy query hook, explicit repo params, and a CI guard) to make cross-tenant leaks a test failure, not a silent bug.
• Integrated Anthropic Claude for single-call ACORD 25 PDF extraction with confidence scoring — ~5x cheaper than an OCR pipeline and validated by an accuracy corpus harness.
• Shipped a per-entity compliance engine that matches certificate holders and additional-insured endorsements against the correct property LLC.
• Built a React + TypeScript + Vite SPA (TanStack Query, React Hook Form, Zod) with a passwordless vendor upload portal and CSV import/export.
• Deployed the full stack to production: Railway (API + worker), Vercel (SPA), Cloudflare DNS, AWS SES email, and Stripe billing.
• Held quality with mypy --strict, ruff, and black on the backend and eslint + tsc on the frontend, backed by ~155 backend and ~43 frontend tests.
• Authored the technical spec, ~18 ADRs, operational runbooks, and production-readiness/business reviews to drive the product from concept to sellable.

Compliance Dashboard

A denormalized, fast-loading rollup of the whole portfolio: how many vendors are compliant, expiring, expired, non-compliant, or missing a certificate, plus a 90-day expiration window and a live 'needs attention' feed. One-click CSV export produces the exact artifact a risk coordinator hands to an auditor.

AI-Powered Certificate Review

The core of the product: a single Claude call reads the uploaded PDF and returns structured ACORD 25 JSON — insured, producer, certificate holder, and each coverage line with limits and endorsement flags — scored with a per-extraction confidence. Low-confidence certificates are routed to a human-in-the-loop review station (PDF side-by-side with editable fields) before they ever go on the record.

Per-Entity Vendor Compliance

Property portfolios are structured as one LLC per property, so a certificate can be valid yet name the wrong entity. The compliance engine checks the certificate holder and additional-insured endorsement against the right organization and surfaces exactly why a vendor is non-compliant — the failure mode generic tools store and ignore.

Vendors & Certificates

Full vendor and certificate management with CSV bulk import, extraction status, and expiry tracking — built to onboard a portfolio of dozens of vendors without re-keying every PDF by hand.

Requirement Templates

Reusable coverage-minimum templates (curated presets plus custom builds) that define what 'compliant' means for a given class of vendor, so the engine has an objective standard to check every certificate against.

Vendor Upload Portal

A passwordless, magic-link upload portal so vendors (or their insurance agent) can submit a COI without an account. A first-page text sniff rejects obvious non-COIs at upload time and tells the vendor immediately, instead of silently landing a wrong document in the review queue.

Automated COI Requests

Request-by-email and automated renewal chasing, delivered through AWS SES with DKIM/SPF/DMARC — the 'done-for-you' half of the product that keeps the portfolio green without the manager policing it.

Organization & Entity Settings

Self-service configuration of the organization's legal name and the list of property entities the compliance engine matches against — the write path that makes per-LLC holder matching real for a multi-entity portfolio.

Append-Only Audit Log

An immutable, append-only audit trail (enforced at the database-role level) of every material action — uploads, reviews, reminders, compliance recomputations — with date filtering and an Excel export for compliance evidence.