System-Enforced Compliance in Real Estate Tech: Automating KYC and Identity Management
Manual KYC and AML checks caused severe bottlenecks for an 800-employee real estate tech firm. We made compliance a system-enforced gate. The Passfort API plugs directly into the HubSpot pipeline, and Microsoft Entra ID (SSO) is enforced. Deals stay physically blocked from "Closed Won" until an unalterable compliance audit trail is verified.
Executive Summary
Context
An 800-employee global software firm requiring absolute regulatory integrity for landlord and agency onboarding across UKI and international regions.
What We Built
An automated compliance gate. A private HubSpot app polls the Passfort API, and a "Hard SSO" configuration runs with managed guest-account exceptions.
Tech Stack
- HubSpot (Sales Hub Enterprise), Passfort API (KYC/AML), Microsoft Entra ID (SAML/SSO), HubSpot Private Apps (Custom Middleware).
Not a fit when compliance is optional, or for organizations without a centralized identity provider (IdP) like Microsoft Entra ID.
The Challenge
A "compliance bypass" risk ran through the entire pipeline. Sales velocity often overrode regulatory caution. The CRM didn't communicate with the compliance stack, so managers couldn't verify whether a landlord had passed KYC before the contract was signed. The 800-user global rollout also demanded a "Hard SSO" mandate. Without specific identity exceptions, that mandate would have locked Salted Stone out during critical testing.
Our Approach
The model is "Zero-Trust" revenue. A custom integration monitors a KYC Requested property; when triggered, the system polls the Passfort API to verify document status. We wrote a validation rule that locks the "Closed Won" stage to enforce it. If the KYC Completed field isn't stamped by the API, the rep can't save the deal in a winning state. For identity management, we mapped SAML certificates in Microsoft Entra ID and configured "Guest Account" exclusions for Salted Stone engineers. Full-scale environment testing ran without compromising the group's security perimeter.
Impact
Automated Regulatory Hard-Gate
Non-compliant deal closures can't happen anymore. The "Closed Won" stage in HubSpot stays physically blocked until a successful Passfort API verification is received.
SSO Governance for 800 Global Staff
Microsoft Entra ID (SSO) now secures access for 800 global staff members. User permissions and offboarding are managed at the enterprise identity level.
Reduced Compliance Processing Lag
Onboarding got faster. The manual "request-and-wait" cycle between sales and legal gave way to a real-time API status sync.
Verifiable Audit Trail
Every landlord and agency now has a compliance record. It's permanent and system-generated. Regulatory audits take less administrative work.
HubSpot's validation logic creates a hard dependency between the KYC Completed property and the "Closed Won" deal stage. Only the API can update that property. Manual overrides by the sales team are impossible.
A global SSO deployment maps internal user roles to HubSpot permission sets. All 800 users get role-appropriate access. That access is revoked automatically when a user is deactivated in the company's primary directory.
A HubSpot Private App bridges the CRM and Passfort. When a rep initiates the KYC workflow, a webhook triggers the API call. The app monitors the external verification process and updates the CRM once the audit succeeds.
We architected an SSO "bypass" to keep security intact during the build. Specifically scoped guest accounts let us perform high-privilege architecture work. The group's "Hard SSO" mandate stayed active for all standard users the whole time.
Manual KYC and AML checks create severe bottlenecks and compliance risks during real estate transactions. Integrating the Passfort API directly into the HubSpot deal pipeline establishes a system-enforced compliance gate. Because deals cannot advance to "Closed Won" without verification, the firm ensures unalterable audit trails and zero-trust regulatory compliance.
FAQ
Yes. The architecture includes a "Guest Account" protocol within Microsoft Entra ID. External partners (like Salted Stone) get controlled, time-limited access without requiring them to join the client's internal domain. SSO enforcement stays at 100% for the 800-person internal workforce.
