Rooted Co-Living
Recovery housing, reimagined.
Software and housing for people in recovery. Rooted runs recovery homes in Southern California and built the operator platform it wished existed: guest management, a resident portal, and a marketplace where case managers find open beds.
- Started
- April 2026
- Platform
- Web + iOS operator app
- Stack
- Next.js, Supabase, Stripe, Cloudflare, Capacitor
- My part
- Founder, operator, sole builder
The problem
Recovery housing operators run everything on spreadsheets, group texts and paper logs. Case managers spend hours calling around to find one open bed. No platform served both sides.
I know because I opened Rooted's first residence in Corona and ran it on those spreadsheets myself. The software came after the housing.
What it does
One codebase, five audiences. Operators get an admin for guests, applications, properties and beds, documents with built-in e-signing, payments, chores, meetings and passes. Guests get a portal with a one-time-code login, a sobriety counter, daily check-ins, house chat and an emergency SOS button that shares location and crisis lines.
Case managers get a marketplace with live bed availability and waitlists. Each operator can run the whole thing under their own white-label site on a rootedcoliving.com subdomain.
The marketplace
Operators list a home free in a few minutes; once reviewed, it appears in search automatically. A referral that goes unanswered for 24 hours releases into a pool for other operators in the same city, claimed first come, first served, with the claim written so two operators can never both win it.
Decisions that shaped it
Multi-tenant from the second org.
The original access rules were fine for one operator and a data breach the moment a second one signed up. In April 2026 every table got an organisation id, row-level security was rewritten, and a pre-push check now refuses any server route that forgets to scope by organisation.
Build to HIPAA before anyone asks.
The platform holds substance-use history, drug tests and medications. Treating that as protected health information from the start means column-level encryption, masked audit logs, a ten-minute idle timeout, approvals on data exports and a business-associate clause in the services agreement. It is also what hospitals and county agencies will require before they refer.
Guests, not residents. Homes, not facilities.
The language rules are written into the brand system. Listings are reviewed, not verified, and the site never claims a certification it does not hold.
Verification is the gate, not tests.
A seven-section pre-push script checks the live schema, tenant scoping and a set of guardrails that each encode a real past outage.
Wildcard subdomains through Cloudflare.
Every operator's site lives at their own subdomain with SSL, resolved on the proxy hot path with a short cache so it costs nothing per request.
Where it stands
- Live at rootedcoliving.com; the operator app runs the same admin inside an iOS shell.
- About 390 commits and 45 migrations since April 2026, with a second security hardening in September 2026.
- Five locations listed on the marketplace.
- Before Rooted takes protected health data from outside operators, attorney review and vendor agreements are still open. That gate is deliberate.
My part
I run the houses and I wrote the software. Founder, operator and the only engineer. I am also a licensed California real estate broker, which is how the housing side started.