How can a property manager test AI on vendor invoices without exposing resident data?

A coding test asks one question of every invoice: where does it post? Answering it takes five pieces of the page, and none of them is a resident.

• Vendor. The name, the remit-to address and the invoice number, enough to match the vendor record and spot a repeat. When the vendor is a person, a handyman or a painter working alone, that name stays: it is the payee.
• Property. The service address, the property or community name, and the unit where the work happened. A unit number is coding data. Who lives behind the door is not.
• GL account. Chosen from your chart, never read off the invoice. HUD's budget worksheet for multifamily projects, form HUD-92547-A, shows how finely a public chart runs: electricity, water, gas and sewer each have an account of their own, 6450 to 6453, while payroll, supplies, contracts and garbage removal sit on separate lines in the 6500s. One combined water and sewer bill can need two lines.
• Amount. The charges for the period, tax, credits and fees, split the way your team posts them.
• Work order. The number, the unit and the work described, so the bill ties to the job your team opened and shows whether a line was billed back.

Resident data rarely sits in those five fields. It rides along in technician notes, in attachments and in whole kinds of invoice that only exist because of one household. Go through the sample by vendor type before anyone starts redacting:

• Maintenance and work orders. Technicians write access notes: a resident's first name, a cell number, a pet to watch for. Photos attached to a ticket can show the inside of a home, mail on a counter or a person.
• Turnover and damage. Move-out cleaning, carpet and repair invoices often name the departing resident when the charge is headed for a deposit or a bill-back.
• Legal and collections. An eviction attorney's invoice lists matters by the resident's name, and a collection agency's statement lists accounts. They still code somewhere, and the HUD worksheet carries a line for project legal expenses, 6340, but almost every detail on them is about a resident.
• Screening. A tenant screening company's invoice can list applicants. The FTC counts reports on tenant history as consumer reports, names landlords among those its Disposal Rule covers, and expects that information to be destroyed so it can't be read or pieced back together.
• Accommodation work. Grab bars, a ramp or an accessible parking sign at one unit can point to a resident's disability. The 2004 joint statement from HUD and the Justice Department on reasonable accommodations says disability information a housing provider receives must be kept confidential and shared only with people who need it to decide the request.
• Access control. Key fob and card invoices sometimes attach credentials listed by unit. In New York City buildings with keyless entry, the Tenant Data Privacy Law bars disclosing the data those systems collect to others unless the law requires it.

Keep everything the five fields need, even when it looks sensitive. Unit 4B, the service address and the work order number all stay. Without them the draft codes blind, and the test measures nothing your AP desk actually does.

Cut what identifies a household: names, phone numbers, emails, signatures on work tickets, and photos of the inside of a home. Where your team billed a line back to a resident, keep the fact and lose the person: mark the line as billed back, with no name, so the draft can be scored on catching it. No resident ledger is needed for that, and none goes in.

Replace instead of deleting wherever invoices are read together. If one resident's name appears on a plumber's invoice and again on a cleaner's, give both the same stand-in, Resident A, so a pattern your team would notice is still there to notice.

Vendors carry personal data too. A W-9 from a vendor who is an individual usually holds a Social Security number, since the form tells individuals that their taxpayer number is generally their SSN, and ACH enrollment forms hold bank account numbers. Neither belongs in a coding test. Massachusetts' data security regulation, 201 CMR 17.00, treats a person's name together with a Social Security number, a driver's license number or a financial account number as personal information, which makes a fair checklist wherever your vendors and residents live.

Some invoices are mostly resident data. An eviction attorney's bill with the names cut out is a column of dates and fees, and a screening invoice with the applicants removed is a single total. Others can't be cleaned because small details still point to one household: the only accessible three-bedroom in a small community, or a repair on a date the whole building remembers.

For those, your reviewer helps us build look-alikes: the same vendor layout and the same kinds of lines, with invented residents and invented case names, plus the coding your team would have used. The FTC's guide Start with Security, updated in August 2023, describes two companies that put real people's data to work, one in employee training and one in apps built by service providers, and says the risk could have been avoided with fictitious information. A coding test is that kind of exercise.

Look-alikes test only what is in them, so build the hard parts in on purpose: a legal invoice split across two properties, a screening charge and the account your team gives it, a repair that was half accommodation work and half routine.

The owner names your reviewer, the person who knows your AP coding best, usually the AP lead or the accountant who closes the books for the most properties. The reviewer chooses 20 to 30 posted invoices, awkward vendor types included, and does the cutting and replacing.

Then someone who did none of the redaction reads every page against the lists above: names, numbers, notes, photos, attachments and the file's own properties. Whoever handles compliance or IT is a good choice, and so is a community manager who knows which details point to one household. Log what went out, page by page, and keep the log on your side.

The NDA is signed before the first file moves, and nothing in the test logs in to your property management system, your bank or a vendor portal. An NDA doesn't decide which privacy rules cover a file, and neither does this note, which is not legal advice: where a state or local rule may reach a document, leave it out and ask your counsel. Massachusetts, for one, expects a business that holds its residents' personal information to choose service providers able to protect it and to require that by contract, so get any vendor's terms for keeping and deleting copies in writing before you send, ours included.