Security measures include encryption in transit and at rest,
strict per-account access controls so each landlord only accesses their own records (every request is scoped to the signed-in account), short-lived signed links for media, time-limited tenant portal links (they expire, a fresh link replaces the old one when it is re-sent, and they stop working once a tenancy ends), and no storage of card details. The account a landlord nominates to receive rent (BSB, account number, PayID) is
additionally encrypted by the application before it is stored, with the key held outside the database. Two things are kept off our systems by design:
identity documents are never stored by us — landlords and applicants alike verify directly with an accredited provider, who keeps the document — and
we never hold or control rent money, which moves bank-to-bank between the tenant's and landlord's accounts. See our
Security page for detail.
Retention: tenancy records — ledgers, messages, notices, condition reports and the photos attached to them — are kept for the life of the account plus
seven years after a tenancy ends, at which point we strip the tenant's personal details and delete the stored documents. (“The life of the account” has an end to it — see
Accounts nobody is using, below.) That reflects the limitation periods for bond and tribunal/court claims (up to six years in most states), so the dated condition evidence is available if a dispute arises long after the tenancy.
Walkthrough video is treated differently and destroyed much sooner, because interior footage of a home is the most sensitive thing we hold: a routine inspection video is deleted
90 days after the landlord reviews it, and entry or exit footage 90 days after the tenancy ends. The dated record of the inspection remains; the footage is gone.
The one exception is footage the landlord has flagged — where they marked a problem in that clip or raised a repair from it. That footage is evidence of a specific issue, so it is kept on the same seven-year clock as the rest of the tenancy record. Unsuccessful rental applications and their attachments are destroyed after
3 months, as are enquiries.
Accounts nobody is using: we don't keep records we're not being asked to look after. If an account has no subscription
and nobody has signed in to it, we close it and delete what's on it — after
90 days where nothing was ever added to it (no property, so no tenancy and nobody else's information), and after
12 months where there are records. We email you 30 days, 7 days and 1 day beforehand, every one of those with a link to download everything first, and
signing in cancels it — there is nothing to click and nothing to pay. If the date passes you get the same 14-day window and the same one-click cancel described under “Closing your account” below, so the earliest anything is destroyed is more than three months after the last time you used it.
Backups: we keep an encrypted second copy of the database and stored files, in Australia, so that a failure on our side cannot destroy your records. Deletions flow through to it, but not instantly — once something is deleted, whether under the windows above or because an account was closed, a copy can persist in backups for up to a further
35 days before it ages out permanently. Backups are only ever used to restore the service.
Error logs: when something breaks, a technical report goes to our error-monitoring provider so it can be fixed rather than silently endured. These reports are stripped before they are sent — no cookies, no form contents, and any link carrying an access token has that token removed — and they are deleted within
90 days.
Problem reports: every screen has a “Report a problem” link. If you use it, we keep what you type, your email address so we can reply, the page you were on and a short list of what your browser was doing — which buttons were pressed and which pages you moved between, recorded by name rather than by content.
We do not take a screenshot and we do not record your screen. That is a deliberate limit: the screens here show tenants' names, addresses and money, and a picture of one would collect all of it from someone who never asked us for anything. Reports are deleted after
90 days, or sooner if you close your account.
Closing your account: a landlord can delete their account themselves, from Settings, and it is a real deletion — properties, tenancies, rent ledgers, messages, condition reports, walkthrough videos, every uploaded document and the login itself. It is not immediate: the request starts a
14-day window in which nothing is deleted, we email you the date, and one click cancels it. That window is there so a deletion nobody intended can be stopped. After it, the only things we keep are our own billing records of what you paid us (a tax record of our business, containing none of your property or tenant data) and a record that a deletion happened — which holds no personal information at all, not even your email address, stored only as a one-way hash so we can answer “did you delete my data?” without keeping the data to answer it with. We can't restore a deleted account, so download your data first.
A data breach likely to cause serious harm is notified to affected people and the OAIC under the Notifiable Data Breaches scheme.