Security measures include encryption in transit and at rest,
strict per-account access controls so each landlord only accesses their own records (every request is scoped to the signed-in account), short-lived signed links for media, time-limited tenant portal links (they expire, a fresh link replaces the old one when it is re-sent, and they stop working once a tenancy ends), and no storage of card details. The account a landlord nominates to receive rent (BSB, account number, PayID) is
additionally encrypted by the application before it is stored, with the key held outside the database. Two things are kept off our systems by design:
identity documents are never stored by us — landlords and applicants alike verify directly with an accredited provider, who keeps the document — and
we never hold or control rent money, which moves bank-to-bank between the tenant's and landlord's accounts. See our
Security page for detail.
Retention: tenancy records — ledgers, messages, notices, condition reports and the photos attached to them — are kept for the life of the account plus
seven years after a tenancy ends, at which point we strip the tenant's personal details and delete the stored documents. (“The life of the account” has an end to it — see
Accounts nobody is using, below.) That reflects the limitation periods for bond and tribunal/court claims (up to six years in most states), so the dated condition evidence is available if a dispute arises long after the tenancy.
Walkthrough video is treated differently and destroyed much sooner, because interior footage of a home is the most sensitive thing we hold: a routine inspection video is deleted
90 days after the landlord reviews it, and entry or exit footage 90 days after the tenancy ends. The dated record of the inspection remains; the footage is gone.
The one exception is footage the landlord has flagged — where they marked a problem in that clip or raised a repair from it. That footage is evidence of a specific issue, so it is kept on the same seven-year clock as the rest of the tenancy record. Unsuccessful rental applications and their attachments are destroyed after
3 months, as are enquiries.
Accounts nobody is using: we don't keep records we're not being asked to look after. If an account has no subscription
and nobody has signed in to it, we close it and delete what's on it — after
90 days where nothing was ever added to it (no property, so no tenancy and nobody else's information), and after
12 months where there are records. We email you 30 days, 7 days and 1 day beforehand, every one of those with a link to download everything first, and
signing in cancels it — there is nothing to click and nothing to pay. If the date passes you get the same 14-day window and the same one-click cancel described under “Closing your account” below, so the earliest anything is destroyed is more than three months after the last time you used it.
Temporary uploads and delivery work: files are first uploaded to private temporary storage. Unused temporary files become eligible for cleanup after 25 hours; failed cleanup is retried. Delivery work may temporarily hold encrypted contact details and message content so a failed notification can be recovered. Accepted delivery clears that content; account closure and the source record's retention cleanup remove the associated work.
Backups: recovery coverage and retention are still being verified before public release. A separate encrypted copy on Amazon Web Services is planned, but is not currently configured. Its planned retention is
35 days; this is not a claim that an offsite copy exists today. Database backups do not include stored document and media bytes. The verified coverage and deletion window will be published before public signup opens.
Error logs: when something breaks, a technical report goes to our error-monitoring provider so it can be fixed rather than silently endured. These reports are stripped before they are sent — no cookies, no form contents, and any link carrying an access token has that token removed — and they are deleted within
90 days.
Problem reports: every screen has a “Report a problem” link. If you use it, we keep what you type, your email address so we can reply, the page you were on and a short list of what your browser was doing — which buttons were pressed and which pages you moved between, recorded by name rather than by content.
We do not take a screenshot and we do not record your screen. That is a deliberate limit: the screens here show tenants' names, addresses and money, and a picture of one would collect all of it from someone who never asked us for anything. Reports are deleted after
90 days, or sooner if you close your account.
Closing your account: a landlord can delete their account themselves, from Settings, and it is a real deletion — properties, tenancies, rent ledgers, messages, condition reports, walkthrough videos, every uploaded document and the login itself. It is not immediate: the request starts a
14-day window in which nothing is deleted, we email you the date, and one click cancels it. That window is there so a deletion nobody intended can be stopped. After it, the only things we keep are our own billing records of what you paid us (a tax record of our business, containing none of your property or tenant data) and a record that a deletion happened — which holds no personal information at all, not even your email address, stored only as a one-way hash so we can answer “did you delete my data?” without keeping the data to answer it with. We can't restore a deleted account, so download your data first.
A data breach likely to cause serious harm is notified to affected people and the OAIC under the Notifiable Data Breaches scheme.