# Kampung Sakinah — Production Readiness Checklist

## 1. Legal and Project Identity
- Confirm the legal project sponsor, SPV, beneficial ownership and authorised signatories.
- Replace conceptual company labels with verified legal names and registered addresses.
- Obtain legal review of all investor, securities, property, privacy and forward-looking statements.
- Publish verified privacy contact, terms of use and applicable governing law.

## 2. Land and Planning
- Confirm the candidate land polygon and UTM coordinates.
- Complete title, encumbrance, dispute, access, LP2B/LSD and spatial conformity checks.
- Update the website with verified land-control status and a dated permit roadmap.
- Replace illustrative transformation imagery with the surveyed site overlay.

## 3. Financial and Investment Materials
- Replace all preliminary figures with the board-approved financial model.
- Confirm CAPEX, revenue, IRR, NPV, phasing, tax and financing assumptions through independent review.
- Use treasury-approved FX rates for each formal roadshow.
- Ensure the calculator is clearly separated from any regulated offer process.

## 4. Authentication and Data Room
- Replace the browser-only access-code demonstration with server-side authentication.
- Implement investor accounts, MFA, role-based access, expiry, revocation and document-level permissions.
- Add watermarking, download controls, full audit logs and confidentiality acceptance.
- Store controlled documents outside the public static website bundle.

## 5. Admin and CRM
- Replace localStorage admin with authenticated CMS or a secured backend.
- Configure verified investor email, WhatsApp Business and CRM webhook.
- Add lead ownership, qualification, consent, retention and deletion workflows.
- Test Netlify forms or migrate to a production API with anti-spam and validation.

## 6. Internationalisation
- Complete professional legal and commercial translations for Arabic, Japanese and Simplified Chinese.
- Review right-to-left Arabic layout and local number/date conventions.
- Confirm investment terminology for each target jurisdiction.
- Create dedicated language URLs and hreflang tags for international SEO.

## 7. Visual and Technical Content
- Replace conceptual 360 and digital-twin demos with commissioned production assets.
- Validate all maps, labels, radii, areas and engineering capacities.
- Add architect, engineer, QS and adviser credits only after appointment and permission.
- Optimise final images to responsive WebP/AVIF variants.

## 8. Security and Privacy
- Verify CSP, HSTS, permissions policy, dependency security and form security.
- Add server-side rate limiting, CSRF protection and webhook authentication.
- Configure data processing agreements, retention periods and cross-border transfer safeguards.
- Run penetration testing for the admin, data room and investor CRM.

## 9. Analytics and SEO
- Configure a verified production domain and canonical URLs.
- Add language-specific sitemap files and Search Console verification.
- Load analytics only after consent; document all cookies and trackers.
- Add organisation, project and place structured data with verified facts.

## 10. Quality Assurance
- Run Lighthouse performance, accessibility, SEO and best-practice checks.
- Test current Chrome, Safari, Edge, Firefox, Android and iOS.
- Test slow networks, keyboard navigation, screen readers and reduced motion.
- Test all downloads, forms, meeting times, currencies, access rules and offline behaviour.