Data security

Database and files

Supabase, hosted on Amazon Web Services in the Sydney region. Client records, uploaded documents and identity-check outcomes are held there.

Application

Vercel. The application itself holds no durable copy of your data; it reads and writes to the database above.

Everything else

The providers named in section 05 of our Privacy policy, each of which is listed there with what it receives and where it operates.

The single most important control in this product is that one agent cannot read another agent's clients. It is enforced in the database rather than in the application, so a mistake in a screen or an API cannot expose another practice's records.

Every table carries row-level security, and access is decided from the authenticated user's identity as the database sees it, not from anything the browser sends. As at our last full schema snapshot on 8 September 2026, all 342 tables in the application schema had row-level security enabled - none without - carrying 638 individual access policies between them.

Where an agency has staff, access follows the role that agency granted, and role checks are performed on the server against the stored membership record.

Information is encrypted in transit and at rest. Connections are HTTPS only: we send Strict-Transport-Security with a one-year lifetime, covering subdomains, on the HSTS preload list, so a browser that has seen the site once will refuse to connect to it insecurely thereafter.

Stored data and backups are encrypted at rest by the hosting provider.

Client documents - anything uploaded against a contact, shared through the client portal, or held as identity-check evidence - are never served from a public address. Each request mints a signed link that expires five minutes later, so a link that is forwarded or leaks stops working. Profile photographs and agency banners on the public directory are public by design, because they are published listings.

Input validation

Every server endpoint checks its input before it acts on it. Most validate against a declared schema; file uploads are held to a fixed list of permitted types and sizes, with the file extension cross-checked against the type the upload claims to be.

Authorisation

Ownership is checked on the server against the authenticated user for every change. The application never trusts a claim from the browser about who owns a record.

Session handling

Session material is held in httpOnly cookies, which page scripts cannot read.

Rate limiting

Public and authentication endpoints are rate limited, with a stricter sliding window on sign-in and payment routes.

Bot protection

Cloudflare Turnstile guards public forms and account creation.

Content Security Policy

The browser is given an explicit list of the hosts allowed to run scripts, load frames or open connections. Anything not on that list is refused by the browser itself.

Payment integrity

Every message from our payment provider is signature-verified before it is acted on. Unverified events are rejected.

Content sanitisation

User-submitted content is sanitised against a strict allowlist before it is rendered.

Errors are reported to Sentry. Personal information is removed and on-screen text is masked before an event leaves the browser, so the error monitor receives diagnostics rather than client records.

Administrative actions taken by our own staff on the operations console are recorded, with who did what and when.

Property data licensed from Cotality is subject to a 30-day retention limit as a condition of that licence. The limit is enforced by a scheduled job rather than by anyone remembering to run it: records are written with an expiry date and removed when it passes.

That data is also blocked from reaching any AI provider, which is a licence condition enforced in the software. See our Cotality data terms.

If information we hold is lost or accessed without authorisation, our Data breach response policy sets out what we do, who we tell and when.

To report a suspected vulnerability or security issue, write to support@buyersagents.com.au with enough detail to reproduce it. We will acknowledge your report and will not pursue anyone who reports a genuine issue in good faith and does not access or alter other people's data while doing so.

We hold no third-party security certification. We are a small Australian company, and where this page describes a control it is because we built it and can show you the code that enforces it - not because an auditor has signed a certificate.

Security is never finished. If a control described here stops being true we will change this page, and the effective date at the top is how you tell which version you are reading.