How we look after your data. Plainly, and only what's true today.

Hosting

• Website, dashboard and API run on Cloudflare, which also stores our database and files. Its network runs in many countries, including Australia and the United States.
• The FTP and SFTP server (feeds.liststream.com.au) runs on a server in Sydney. It passes each file to ListStream as soon as it arrives and deletes its copy once ListStream has accepted it.
• Sign-in is provided by Google (Firebase Authentication). Account emails are sent by Cloudflare from noreply@liststream.com.au.

Encryption

• Every page and API call uses HTTPS. Our providers encrypt stored data.
• CRMs deliver files over FTPS (FTP with TLS) or SFTP. Plain, unencrypted FTP is off unless an agency turns it on for its own login, after a warning.
• Webhooks we send are signed (HMAC-SHA256, with a timestamp) so your endpoint can check they came from us.

Who can see and change what

• Each agency sees and changes only its own account and listings. Only listings carrying its ListStream ID are accepted for it.
• Within an agency, only the owner can change its details, approve CRMs and manage feed logins. Agents the owner invites can upload and view.
• A CRM can send listings for an agency only after that agency approves it, and the agency can revoke that at any time. A CRM never sees another agency's data.
• Feed addresses we fetch must be public: private and internal addresses are refused, including after redirects.
• Access to our systems is limited to the people who run ListStream.

Keys, tokens and passwords

• We never see or store your password: sign-in is handled by Firebase Authentication. Passwords need at least 10 characters with upper and lower case letters and a special character.
• Email codes (for confirming an address or resetting a password) are stored only as a hash, expire after 15 minutes and allow 5 tries.
• API client secrets, FTP passwords and push tokens are shown once and stored only as hashes. Revoking a key stops it straight away, including access tokens already issued from it. Access tokens last an hour.
• Test keys can only send to your sandbox ID, and test deliveries are never published.
• The API and sign-in endpoints are rate limited.

What we keep

• Vendor, landlord and buyer details are removed from delivered files when they're processed, and never published.
• Copies of delivered files are kept up to 90 days to fix problems, then deleted. The raw files are never public.
• Prices an agency marks as hidden are never published, and neither are street addresses it withholds.
• More detail is in our Privacy policy.

Data breaches

If a data breach is likely to cause serious harm, we will assess it promptly, notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and tell you what we are doing about it.

Report a vulnerability

Email security@liststream.com.au with what you found and how to reproduce it. Please don't access or change other people's data, run denial-of-service tests, or make your findings public before we've had a reasonable chance to fix them. We'll acknowledge your report and keep you updated. Our security.txt has the same details.