~/contents
| client | PVO Brabant — a public-private crime-prevention partnership |
| role | Sole developer — mobile app, admin panel, backend |
| stack | Flutter · Firebase · Dutch Chamber of Commerce API |
| status | MVP delivered, ran in production · 2022–2024 |
Organised crime needs premises. Cannabis cultivation and synthetic drug production happen in ordinary rented buildings — units on business parks, storage spaces, houses — and the person best placed to notice is the one who owns the building.
The problem is that landlords aren’t trained investigators. They don’t know that a carbon filter turns up in both a cannabis grow and a drug lab, that an MDMA lab has a distinctive anise smell, or that a distillation vessel means stop and call the police rather than ask a question. Meanwhile the consequences of renting to the wrong tenant land on them: property damage, fire risk, and legal exposure.
PVO Brabant — a partnership between government, police and business — works on exactly this. They had the expertise. They needed it to reach landlords in a form that survived contact with a busy person who is not a security professional.
I built the platform that did it: teach, screen, inspect. I was the only developer, across a mobile app for landlords, an admin panel for the organisation, and the backend behind both.
The interesting part was the data model
Most of this project’s difficulty wasn’t technical. It was turning professional judgement into structured fields without flattening it into a meaningless form.
Take the inspection. A trained officer walking through a building forms an overall impression from dozens of small signals. You cannot ship “form an overall impression” to a landlord. What you can ship is a specific, ordered set of observations — is there a room that isn’t on the floor plan, is there ventilation you can hear but not explain, does the space smell wrong — each one a field, each one photographed.
The photo requirements encode expertise too. The inspection captures room images and a separate set for closets and enclosed spaces, because concealed areas behind them are a known pattern. A generic “attach photos” field would have collected exactly the wrong pictures.
The same applies before anyone moves in. The screening asks whether the tenant’s bank account is in their own name, and whether they hold the energy contract themselves. Those sound like administrative trivia and they are not — they’re indicators, because arrangements designed to keep a real occupant’s name off paperwork tend to show up in exactly those places. A landlord filling in that form is running a professional screening process without needing to know the reasoning behind each question.
That’s the design problem this product actually solved. The domain expertise existed inside an organisation. My job was to encode it so that following the form is following the doctrine.
Verifying the tenant is who they claim
A screening starts with the prospective tenant’s business. The app queries the Dutch Chamber of Commerce registry directly to pull the registered entity, its address data and its status — so the landlord is checking against the official record rather than a business card.
That integration is authenticated with a client certificate, not just an API key. The HTTP client is constructed with its own security context and the certificate loaded at call time. It’s a small piece of code and it was the fiddliest part of the integration, because certificate-based mutual authentication fails in ways that look nothing like the usual API errors.
Around that sits the rest of the file: contact details, intended use of the premises, rent and financial arrangements, and uploaded supporting documents including a certificate of good conduct. The output is a structured record the landlord keeps — and, importantly, evidence that they performed due diligence, which matters if something later goes wrong.
Where the data was allowed to live
This was a government client, so data protection wasn’t a feature request — it was the frame around every decision. GDPR obligations and ISO information-security requirements applied from the first conversation, and the platform holds material that earns that scrutiny: certificates of good conduct, income documents, financial arrangements, and photographs of the inside of people’s buildings.
The requirement that shaped the architecture hardest was data residency. Everything had to be stored and processed on servers in the Netherlands. Not “in the EU” — in-country.
That’s a cloud platform decision, and specifically one you cannot walk back. The location of the underlying datastore is fixed when it’s created; there is no setting to change afterwards and no migration that isn’t a rebuild. Get it wrong on day one and the fix is starting over, discovered at exactly the point where discovering it is most expensive.
So the region selection came before any schema design — pinned to a Dutch region, with the file storage aligned to match, because the documents are the most sensitive part of the system and splitting the residency of records from the residency of the files they point at would have defeated the purpose entirely.
It’s one line of configuration and one of the more consequential decisions on the project. That combination — cheap to set, impossible to undo, invisible if you don’t know to ask — is the shape most compliance architecture takes.
Teach first, because the checklist only works if you understand it
The part I liked most is the training module.
A landlord who fills in an inspection form without understanding it produces noise. So the app includes a quiz that teaches the signals directly — what carbon filters mean, which observations warrant immediate police contact rather than a note, what an amphetamine lab actually smells like. Each answer comes with the reasoning, sourced from the police and the platform’s own material.
It changes the product from a compliance form into a behaviour-change tool. The inspection checklist that follows works because the person completing it now knows what they’re looking at.
The training was PVO’s idea and PVO’s material — they know this subject far better than I do. My part was working out how it should function in the app and building it. Worth saying plainly: the domain expertise on this project was theirs throughout. Mine was turning it into something that worked in someone’s hand on a business park.
Property, evidence and reporting
Properties carry their land-registry number, address and coordinates, so an inspection is anchored to a specific building rather than a name someone typed. Inspections produce a PDF report the landlord can file or hand over.
The admin panel gave the organisation the other side: oversight of the properties, screenings and inspections flowing through the platform, which is what turns a collection of individual landlord checks into something a crime-prevention partnership can actually act on.
How it ended
The MVP was delivered and ran in production for several months. The government body sponsoring it was then wound up, and the project didn’t survive the transfer to another department.
That’s an ordinary way for public-sector work to end and it says nothing about the software, but it’s worth stating plainly rather than letting a date trail off.
What I'd take from it
Two things.
Domain modelling is the work. The Flutter app itself was routine, and the value was in sitting with people who knew what a compromised building looks like and turning that into fields, photo requirements and question ordering that still hold up when a non-expert is using them on their own. I have reached for that instinct on every regulated project since, and I think the software is rarely the hard part on this kind of job.
And compliance constraints are architecture, so they belong at the start. Data residency had to be settled before a single collection was designed because it could not be changed afterwards, and the same is true of most of them. The access model, what gets retained and for how long, what a deletion request actually requires. Every one of those is nearly free to decide up front and expensive to retrofit. Working under GDPR and ISO requirements here is where that stopped being a principle I agreed with and became the order I actually work in.
If this is the kind of problem you have, here is how I work on it. The other regulated delivery on this site is First Impress, where the data belonged to minors.