Every job here is yours. Four of them don't have to be.

Short-term rental permitting is municipal, not federal, and the rules differ street by street: registration numbers, occupancy caps, primary-residence requirements, night limits, inspection cycles, and renewal dates. A growing number of jurisdictions require the permit number to appear on every public listing and on the booking confirmation.

The platform risk is quiet: a permit lapses, bookings keep taking money, and the first you hear of it is a citation per booking.

We build: permit fields on the property record with expiry dates, automatic display on listing and confirmation, renewal alerts at 60/30/7 days, and a hard block that takes a unit off sale the day its permit expires.

Lodging tax typically stacks: a state transient tax, a county tax, a city tax, and sometimes a tourism-district assessment — each with its own rate, base, exemption for long stays, and filing calendar. Rates are set by the address of the property, not the address of your business.

Selling direct also raises a question the marketplaces answered for you: whether your platform is a marketplace facilitator with collection duties of its own. That determination is your counsel's; the system has to be able to implement either answer.

We build: a per-property tax profile, stacked rates computed and stored per booking in USD, exemption handling for stays over the local threshold, a separate tax line on every receipt, and a remittance-ready export per jurisdiction per period.

This is the one most booking engines get wrong, because it is a data requirement rather than a front-end one. The ADA's reservation rule for places of lodging (28 CFR 36.302(e)) requires accessible units to be described in enough detail for a guest to decide independently whether the unit meets their needs, to be reservable in the same way and during the same hours as every other unit, to be held out of general inventory once the rest of that type is booked, and to be guaranteed to the guest who reserved them.

"Call us to discuss accessibility" is not compliance. Neither is an accessible unit that the engine can silently reassign.

We build: structured accessibility attributes per unit (entry, doorway widths, bathroom configuration, surfaces, alerting devices), accessible units flagged and filterable, hold-back logic in the availability engine, and a no-reassignment lock on any booking made against an accessible unit.

The FTC's Rule on Unfair or Deceptive Fees took effect on 12 May 2025 and names short-term lodging explicitly. Where a price is advertised, the total price including every mandatory fee must be shown up front and displayed more prominently than any other pricing figure. Cleaning fees, resort fees, booking fees, linen fees and the rest cannot wait until the last screen.

Government charges and shipping may be excluded from the headline figure but must be disclosed before the guest pays. Several states run their own parallel total-price statutes.

We build: a single price object that computes the all-in nightly and stay total at search time, mandatory fees folded into the displayed figure everywhere a price appears, and a pre-payment breakdown that itemizes taxes and optional add-ons separately.

Under FinCEN's guidance on convertible virtual currencies, accepting value from one person and transmitting it to another can make you a money services business, with registration, an AML program, a compliance officer, training, and recordkeeping attached. Custody is the hinge. A platform that takes a guest's stablecoin into a wallet it controls and later pays an owner has done something very different from a platform that never touches the funds.

This is the single most consequential design decision in the project, and it is made in week one — not after the checkout is built.

We build: non-custodial settlement by default. The guest pays directly to a wallet address the operator controls, we never hold keys or pooled balances, and we produce a written architecture memo describing exactly what the system does and does not touch, in the form your counsel needs to render an opinion.

Federal analysis is only half of it. Money transmission is licensed state by state, across 49 states and the District of Columbia, and the definitions, exemptions and virtual-currency treatments are not uniform. A structure that is plainly exempt in one state can be a live question in the next.

Multi-state operators feel this first, because the analysis follows the states you take money in, not the state you incorporated in.

We build: an architecture whose entire purpose is to keep you out of the flow of funds, plus a per-state exposure matrix your attorney can work from — properties, payment paths, and the funds-flow diagram for each.

The GENIUS Act, signed in July 2025, created a federal framework for permitted payment stablecoin issuers and reserve standards. Which issuers you accept is now a policy decision with legal weight, not a technical preference.

There is a second, more immediate risk. On-chain, anyone can deploy a token called USDC. A checkout that accepts payment based on a token's name rather than its contract address can be paid in something worthless and mark a stay as settled.

We build: a hard allowlist of accepted issuers by contract address and chain, decimal and amount verification, confirmation-depth thresholds before a booking is marked paid, and a policy record showing which issuers were approved and when.

OFAC obligations are strict liability and asset-agnostic. They apply to a guest paying in dollars and a guest paying in stablecoin, and OFAC has published blocked digital-currency addresses. Screening after settlement is not screening.

We build: sanctions screening on the guest record and on the paying wallet address at quote time — before a payment intent is created — with blocked attempts refused, logged with the reason, and surfaced to an admin queue rather than failing silently.

The IRS treats digital assets as property. Rental income paid in stablecoin is recognized at its US dollar fair market value at the moment of receipt, and that value becomes your basis — so any later movement of the asset is a separate taxable event. Card and ACH volume brings 1099-K reporting; the digital asset broker reporting regime brings Form 1099-DA into the picture.

Meanwhile, lodging tax is owed in dollars regardless of what the guest paid with.

We build: fair-market-value capture at receipt with the rate source and timestamp recorded, every booking stored in USD alongside the settlement asset, a per-booking basis record, and an accountant-ready export covering income, tax collected, fees, and refunds by period.

Card payments are reversible by the guest for months. On-chain payments are reversible by nobody, ever. Running both rails behind one cancellation policy without writing that asymmetry into the terms is how a refund becomes a dispute.

Two questions have to be answered in the policy before they are answered in code: is a stablecoin refund returned in the same asset or in dollars, and who carries the price movement between payment and refund?

We build: refund-destination capture at checkout, a cancellation engine that applies your published policy per rail, refunds priced on a disclosed basis, an irreversibility notice the guest acknowledges before paying on-chain, and a chargeback evidence pack assembled automatically from the booking record.

PCI DSS v4's future-dated requirements became mandatory on 31 March 2025, and two of them target exactly the kind of page you are about to build: every script on a payment page must be inventoried and authorized, and changes to the payment page as received by the browser must be detected. A well-meaning marketing tag on the checkout is now a finding.

We build: card data that never reaches your VPS — hosted fields and tokenisation only, keeping you in the lightest self-assessment category — plus a locked script inventory on the payment route, a strict content security policy, integrity monitoring, and a written record of the controls for your acquirer.

Sending business SMS to US mobile numbers requires registering your brand and each campaign under the carriers' A2P 10DLC framework. Unregistered traffic is filtered or blocked outright, and vetting takes real calendar time — which is why we start it in week one rather than the week before launch.

Separately, the TCPA governs consent. A transactional booking receipt and a "20% off your next stay" message are not the same category, and one promotional sentence appended to a receipt moves it into the other one. Statutory damages run per message.

We build: 10DLC brand and campaign registration handled end to end, channel preference captured with timestamped consent at booking, transactional and marketing templates kept strictly separate, STOP and HELP honored automatically with quiet-hours handling, and a permanent send log per guest.

A transactional email carries lighter obligations than a commercial one — until you add a promotional block to it, at which point CAN-SPAM's identification, physical address and opt-out requirements attach to the whole message.

Deliverability is the practical risk. A receipt that lands in spam is, for the guest, a receipt that was never sent, and the major mailbox providers now enforce authentication and complaint-rate thresholds for bulk senders.

We build: SPF, DKIM and DMARC configured and verified on your sending domain, transactional and marketing streams separated onto different subdomains, physical address and unsubscribe on every commercial send, and bounce, complaint and delivery tracking wired to the booking record.

California's CCPA/CPRA is now joined by comprehensive privacy statutes in a long and growing list of states, most sharing a common shape: a notice at collection, access and deletion rights, opt-outs from sale and targeted advertising, data minimization, and written terms with every processor you use. Several require you to honor the Global Privacy Control browser signal automatically.

A booking record is unusually rich — identity, address, payment, travel dates, sometimes a wallet address — which raises the stakes on retention.

We build: a privacy notice wired to what the system actually collects, a data subject request workflow with identity verification and an audit trail, GPC signal handling, a documented retention schedule with automatic purge, and a processor inventory covering every vendor in the stack.

Places of public accommodation attract web accessibility claims, and lodging is a frequent target. Cases overwhelmingly cite WCAG as the working standard, so WCAG 2.2 Level AA is what we build and test to.

Booking flows fail in predictable places: date pickers that cannot be operated from a keyboard, check-in time selects with no accessible name, error messages announced to nobody, focus lost inside a payment modal, a session timeout with no warning, and a receipt page that never tells assistive technology the booking succeeded. This sits directly on top of §03, and the two are cheapest to satisfy together.

We build: keyboard-operable date and time selection, programmatic labels and error association, live-region announcements for availability and payment states, visible focus everywhere, reduced-motion support, target sizes and drag alternatives per WCAG 2.2, testing with screen readers rather than only automated scanners, and a VPAT/Accessibility Conformance Report on delivery.

Rental agreements, house rules, damage terms and cancellation policies signed online are governed by the federal E-SIGN Act and state UETA equivalents. They are enforceable when the guest consents to doing business electronically, can retain a copy, and the record is attributable and unaltered.

We build: consent-to-electronic-records captured before signature, agreements rendered and stored as immutable PDFs with a signing audit trail — identity, timestamp, IP, document hash — attached to the booking, and a permanent copy available to the guest.

Every US state has a breach notification statute, and the clocks are short. A platform holding guest identity, payment tokens, and door codes is a target with physical consequences — a leaked lock code is a different category of incident from a leaked mailing list.

We build: encryption in transit and at rest, secrets in a managed key store with no credential in the repository, least-privilege access with audit logging, door codes issued per stay and expired on checkout, backups tested by restoring them rather than by checking a box, and a written incident response plan naming who calls whom.

Direct booking removes a marketplace's terms of service, insurance product, and damage-claim process from between you and the guest. Whatever they were doing, your own terms now have to do — cancellation, damage, liability, house rules, dispute resolution, and what your insurance actually covers when a stay goes wrong.

Listing copy and any automated screening also have to stay clear of protected characteristics; longer stays can cross into landlord-tenant territory, where a different body of law applies entirely.

We build: the terms, policy and disclosure surfaces wired into booking and acceptance so the guest agrees to the current version and you can prove which one; versioned policy records; and screening criteria kept to objective, documented rules. Drafting the terms themselves is your counsel's work — we implement them.