System-Enforced Compliance in Real Estate Tech: Automating KYC and Identity Management
Manual KYC and AML checks caused severe bottlenecks for an 800-employee real estate tech firm. We made compliance a system-enforced gate: the Passfort API plugs directly into the HubSpot pipeline, and Microsoft Entra ID (SSO) is enforced across the org. Deals stay blocked from "Closed Won" until an unalterable compliance audit trail is verified.
Executive Summary
Context
An 800-employee global software firm needed absolute regulatory integrity for landlord and agency onboarding across the UKI region and beyond.
What We Built
We built an automated compliance gate: a private HubSpot app polls the Passfort API, and a "Hard SSO" configuration runs with managed guest-account exceptions.
Tech Stack
- HubSpot (Sales Hub Enterprise)
- Passfort API (KYC/AML)
- Microsoft Entra ID (SAML/SSO)
- HubSpot Private Apps (Custom Middleware)
Not a fit if you have no KYC or AML verification vendor with an API to poll, since the hard stage lock depends on an external system stamping that verification rather than HubSpot judging compliance itself. It is also not a fit without a centralised identity provider such as Microsoft Entra ID, since the SSO enforcement and guest-account exceptions are built against that directory.
The Challenge
Sales velocity often overrode regulatory caution because nothing in the system enforced it. The CRM was not connected to the compliance stack, so a manager had no way to verify that a landlord had passed KYC before a contract was signed.
The 800-user global rollout came with a hard SSO mandate. Without specific identity exceptions, that mandate would have locked Salted Stone out of the environment during critical testing.
Our Approach
The model applies zero-trust logic to revenue: a deal cannot close until the system, not a person, verifies compliance. A custom integration monitors a KYC Requested property and, when it fires, polls the Passfort API for the document status. A validation rule on the Closed Won stage enforces the result, so if the API has not stamped KYC Completed, the rep cannot save the deal in a winning state.
For identity management we mapped SAML certificates in Microsoft Entra ID and configured Guest Account exclusions for Salted Stone engineers, which allowed full-scale environment testing without opening a hole in the group's security perimeter.
This engagement is part of our systems integration work for real estate & property organisations.
Impact
Automated Regulatory Hard-Gate
Non-compliant deal closures can't happen anymore. The "Closed Won" stage in HubSpot stays blocked until a successful Passfort API verification is received.
SSO Governance for 800 Global Staff
Microsoft Entra ID (SSO) now secures access for 800 global staff members. User permissions and offboarding are managed at the enterprise identity level.
Reduced Compliance Processing Lag
Onboarding got faster. The manual "request-and-wait" cycle between sales and legal gave way to a real-time API status sync.
Verifiable Audit Trail
Every landlord and agency now has a permanent, system-generated compliance record, and regulatory audits take less administrative work as a result.
HubSpot's validation logic creates a hard dependency between the KYC Completed property and the "Closed Won" deal stage. Only the API can update that property. Manual overrides by the sales team are impossible.
A global SSO deployment maps internal user roles to HubSpot permission sets. All 800 users get role-appropriate access. That access is revoked automatically when a user is deactivated in the company's primary directory.
A HubSpot Private App bridges the CRM and Passfort. When a rep initiates the KYC workflow, a webhook triggers the API call. The app monitors the external verification process and updates the CRM once the audit succeeds.
We architected an SSO "bypass" to keep security intact during the build. Specifically scoped guest accounts let us perform high-privilege architecture work. The group's "Hard SSO" mandate stayed active for all standard users the whole time.
Nothing in the CRM connected to the compliance stack, so a manager couldn't verify that a landlord had passed KYC before a contract was signed. Now a custom integration watches the "KYC Requested" property and polls the Passfort API for the document status. A validation rule on the Closed Won stage then blocks the save. A rep can mark a deal won only if the API has stamped "KYC Completed".
FAQ
Yes. The architecture includes a "Guest Account" protocol within Microsoft Entra ID. External partners (like Salted Stone) get controlled, time-limited access without requiring them to join the client's internal domain. SSO enforcement stays at 100% for the 800-person internal workforce.
