Information security

This policy applies to all information we hold or process in operating the directory and the software, and to everyone who works on it, whether employed or engaged as a contractor.

Published

Directory profiles, reviews, articles and guides. Intended to be public. Protected for integrity, not confidentiality.

Account

Agent identity, contact details, subscription state and authentication records. Confidential.

Client

Everything an agent records about the people they act for: contacts, notes, briefs, documents, correspondence, call recordings and transcripts. Confidential, and treated as the most sensitive category in the product because it belongs to somebody who is not our customer.

Verification

Identity documents, facial images and screening results. Sensitive information under the Privacy Act. Held under the additional restrictions described in section 07 of our Privacy policy.

Licensed

Property data supplied under licence from Cotality. Confidential, subject to a contractual 30-day retention limit, and barred from being sent to any AI provider.

Access follows least privilege. An agent reaches their own practice's records and no one else's, and that boundary is enforced by the database rather than by the application.

Our own staff do not browse customer records as a matter of course. Access to the operations console is restricted, and administrative actions taken there are recorded with who did what and when. Where support requires looking at an account, it is done for a stated reason and leaves a record.

Credentials for third-party services are held as environment secrets, never in source code. Every commit and every scheduled scan is checked for accidentally committed secrets, and a commit containing one is refused.

Code changes are gated automatically when they are committed, and again in continuous integration on every push to a shared branch:

• static type checking, with no suppressions permitted - there are none anywhere in the application code today;
• linting against our published code standards;
• a secret scan, which is the one gate never narrowed to the files being changed, so it still runs on a change that only deletes;
• the automated tests covering the code being changed; and
• the full test suite, type check and lint again in continuous integration.

The production branch cannot be force-pushed or deleted, and that restriction has no bypass for anyone, including us. It does not require a second person to approve a change. We are a small company and on a one or two file production fix the author is the reviewer - we would rather write that down than imply a separation of duties we do not have.

Dependencies are audited on every push and daily on a schedule. That audit reports rather than blocks: a new advisory raises something for us to judge, it does not by itself stop a release.

Every external service that receives personal information is listed by name, with what it receives, in section 05 of our Privacy policy. That list is the register: a provider that is not on it should not be receiving anything, and adding one is a decision that updates the policy at the same time.

Before adding a provider we consider what it would receive, where it operates, whether the same outcome is achievable without sending personal information, and what happens to the data if we stop using it.

Licensed property data is deleted after 30 days automatically. We do not currently operate an automatic retention schedule for other categories, and we say so plainly in section 09 of our Privacy policy rather than implying a schedule that does not exist.

Deletion requests are handled as described in section 13 of that policy, subject to records we are required to keep by law.

Buyers Agents Technologies Pty Ltd is accountable for this policy. Questions, concerns and reports go to support@buyersagents.com.au.

We are a small Australian company. We would rather describe a modest set of controls we genuinely operate than a comprehensive framework we do not.

This policy is reviewed when the platform changes materially, and at least annually. The effective date at the top is the version you are reading.