The system of record for a family's investments

A family office that holds a few hundred private investments through dozens of legal entities, owns a portfolio of properties each run by a different manager, lends to its own projects and operating companies, and still has to close its books every month and file its taxes every spring, outgrows spreadsheets quietly and then all at once. For years this office ran on a set of linked workbooks, a general ledger that did not know what a deal was, and a few people who remembered how the pieces fit together. This platform replaced that, one domain at a time, until the workbooks could be retired.

It is used daily by everyone who touches the money. The controller runs the month-end close in it, against the QuickBooks postings it pulls in, and reconciles cash, brokerage and vendor statements from the same screens. The investment side records marks, distributions and capital calls, and reads performance by deal, vintage, manager and asset class. The real-estate side reviews every property's monthly package, approves the translated figures and compares managers on the numbers they sent. The principal reads a dashboard, a personal financial statement and a weekly cash report that all come from the same rows. In tax season the K-1 tracker, the booked-income check and the capital roll-forward replace the spreadsheet that used to be built from scratch each year.

Two ideas run through all of it. The first is attribution: a deal is stored once per holding entity, and the ownership chain attributes every dollar to the family exactly once, so the dashboard, the entity pages and the deal pages can never disagree about what the family owns. The second is provenance: every figure that came from somewhere else — a manager's statement, a sponsor's notice, a QuickBooks posting, a document filed by the sibling Documents app — keeps a link back to the thing it was read from, so a number on screen can always be checked against the page that produced it.

The Family Office platform is the system of record for a single family's investments: every deal, the entity that holds it, what was put in, what it is worth, and every dollar that has come back. It replaced a set of linked workbooks, and most of its rules exist because a workbook once got them wrong.

Some of the parts worth a look:

• One deal, many rows. A deal held through several entities is stored once per holding entity, and every figure is attributed to the family exactly once through the ownership chain, never twice.
• Returns come from the ledger. Distributions are classified from the actual transaction lines (operations, capital, sponsor economics), so the multiples on screen can be traced to the postings behind them.
• Real estate is its own book. Each property carries its statements, debt, capital projects and valuation inputs, and the dashboard rolls them up by state, manager and stage.
• The tax season is tracked, not remembered. Which K-1s are expected, which arrived, which entities file what and when, and the action items that fall out of the review.

Python and Flask on PostgreSQL, with SQLAlchemy models over a schema of some one hundred and forty tables; server-rendered Jinja pages with Alpine.js for the interactive parts and Chart.js for the charts. It runs as a web service and a separate worker process, so an overnight job or a long import can never take a page down.

• QuickBooks Online is the ledger of record. Its postings are pulled into the platform through the QuickBooks API and kept as a mirror, and every cash, close, booked-income and recurring-cash page reads those same rows rather than a copy of its own.
• Documents arrive from the sibling apps. The Documents app files each manager package into the office's library and the platform ingests it, translates it through the manager's chart-of-accounts mapping and keeps the ingest as the provenance of every figure; the Stocks app publishes the public-equities positions the dashboard consolidates.
• Translation is data, not code. Each manager's format is a set of mapping rows from their account names to the platform's standard terms, edited in the app; a line the mapping does not know is reported on the tie-out rather than silently dropped.
• An audit trigger in the database records every insert and delete on the sensitive tables, with the session, the application and the connection that made it, outside the reach of application code.
• Office add-ins for Excel and Outlook let the team file a document, pick a record or pull a figure without leaving the spreadsheet or the mail client.
• Over ten thousand tests, checked by mutation: each defect a test guards against is re-introduced on purpose to prove the test can actually fail. Boot-time migrations run under a database advisory lock, every push deploys through a serialised safe-deploy, and every database and repository is captured nightly to two object stores, one of them immutable, from which the whole platform has been rebuilt in a rehearsal.

The code itself is private. If you would like to walk through it, get in touch.