Release Notes

Tenant-Native Loan Origination -- Each accounting entity now owns and customizes its own origination configuration (product types, decision rules, application pipeline) in its own database, fully isolated from every other tenant.

Hardened Authentication -- Refresh tokens are now held in HttpOnly, SameSite-Strict cookies with CSRF double-submit protection and a login origin allowlist; access tokens are short-lived and held in memory only.

Reporting & Analytics Fixes -- Loan, note, and financial-performance BI suites, the ALM dashboard, and the chart of accounts now load correctly for an active entity, with clearer loading and error states.

Expanded API Documentation -- The OpenAPI specification now reflects the cookie/CSRF auth contract, the per-entity x-entity-id header, and additional admin and compliance services.

Standalone Deployment on Hetzner Cloud-- Migrated from Firebase Cloud Functions to a dedicated Hetzner CPX31 instance with SSL via Let's Encrypt, providing lower latency and full infrastructure control.

JWT Authentication System -- Production-ready authentication with 24-hour access tokens, 7-day refresh tokens, and HS256 signing. Supports dual-mode authentication for backward compatibility with Firebase ID tokens.

Complete Loan Servicing Module -- End-to-end loan lifecycle management including origination, payment processing, amortization schedules, payoff calculations, and delinquency tracking.

Investor Note Tracking -- Full investor note management with interest accrual, maturity tracking, reinvestment handling, and automated 1099-INT generation.

Double-Entry General Ledger -- GAAP-compliant general ledger with chart of accounts, journal entries, trial balance, balance sheet, and profit-and-loss reporting.

CRM for Ministry Organizations -- Purpose-built CRM for managing church relationships, contacts, prospects, and organizational hierarchies.

Maker-Checker Workflow -- Four-eyes principle enforcement for all financial transactions exceeding configurable thresholds, with full approval audit trails.

Immutable Audit Trail -- Tamper-evident audit logging with cryptographic hash chains, ensuring regulatory compliance and forensic traceability for every financial operation.

Cash Management and Escrow Tracking -- Receipts, disbursements, reconciliation, and escrow account management with real-time balance tracking.

Report Builder with Interactive Charts -- Interactive report templates, custom report generation, PDF and Excel export, and visual dashboards with interactive charts.

Monitoring and Alerting Dashboard -- Real-time system health monitoring with PagerDuty and Slack integration for critical alerts, uptime tracking, and performance metrics.

Bank Feed Integration via Plaid -- Automated bank transaction import, account verification, and reconciliation support through the Plaid financial data network.

Statement Generation Engine -- Automated monthly investor statements with PDF generation, batch processing, and configurable templates.

1099-INT Reporting Automation -- End-of-year 1099-INT form generation, IRS e-filing preparation, and investor tax document distribution.

OpenAPI Documentation -- Interactive Swagger UI for all API endpoints with request/response examples and authentication guides.

Customer Self-Service Portal -- Read-only portal for investors and borrowers to view their accounts, statements, and transaction history.

Modular Subledger Architecture -- Eight independent Express.js microservices (GL, Loans, Investor Notes, Cash, Escrow, Fees, CRM, Reports) each deployed as isolated Cloud Functions.

PostgreSQL Database Foundation -- 10 database schemas with UUID primary keys, soft-delete support, event outbox pattern, and idempotency key deduplication.

Firebase Authentication Integration -- Secure user authentication with Firebase Auth, custom claims for RBAC, and internal service-to-service token support.

Next.js Dashboard -- 21-page static site with responsive design, including dashboards for loans, investor notes, accounting, CRM, and administrative functions.

Idempotency for Financial Operations -- Request deduplication using idempotency keys to prevent duplicate transactions, ensuring exactly-once processing for all money operations.

Automated Scheduled Jobs -- Daily accrual processing, tie-out verification, bank transaction sync, audit log archival, and database backup export.

Smoke and Integration Test Suite -- Comprehensive automated testing with 62 smoke tests and 10 integration tests, JSON reporting, and CI/CD pipeline support.