Security, access & records
Who may see what, how agents prove who they are, and how long records are kept. This is the page an auditor, a lawyer or a regulator would ask for first.
1 Access matrix — least privilege by role
| Function | Agency Head | Team Leader | Negotiator | Operations | Finance | Client |
|---|
Rules that matter: a negotiator sees only their own deals. A Team Leader sees the team they introduced. Commission figures of other agents are never visible to peers. Operations can prepare and send documents but cannot change fees. Only the Agency Head approves a payout. A client sees only the documents of their own transaction.
2 Agent identity & sign-in
Two-factor authentication for agents
| Control | Setting |
|---|---|
| Sign-in | Email + password, then a 6-digit code (app or SMS) |
| Mandatory for | Every role except the client view |
| Devices | New device requires code + email alert to the agent |
| Sessions | Expire after 12 hours of inactivity; one active device per agent by default |
| Failed attempts | 5 wrong passwords locks the account for 30 minutes and alerts the Agency Head |
| Offboarding | Access revoked the same day the agent leaves; documents and audit log are kept |
Signature links issued to clients
| Control | Setting |
|---|---|
| Personal | One link per party, never shared or forwarded |
| Expiry | 7 days by default; new link required after that |
| Single use | Link stops working once that party has signed |
| Revocable | Agency can revoke instantly; old links die when a new version is issued |
| OTP | 6-digit code, 3 attempts, then the link locks for 30 minutes |
| Logged | Every open, OTP failure, signature, decline and expiry |
3 Backup & retention
| What | How | How long |
|---|---|---|
| Documents & certificates | Every signed package written to the transaction folder; hash recorded | 7 years |
| Audit log | Append-only, each entry chained to the previous fingerprint | 7 years (not editable, not deletable) |
| Daily backup | Automatic copy off the server every night | 7 days rolling |
| Monthly backup | Second copy at a different location, checked monthly | 24 months |
| Restore test | Performed quarterly and recorded with the result | Result kept with the audit log |
If a document is ever lost from the working system it is restored from backup with its audit log, so the chain of custody survives. Nothing is ever hard-deleted: a cancelled document is marked VOID and keeps its number.
4 Client money — the rule this system follows
Why this matters: under the Valuers, Appraisers and Estate Agents Act 1981 and the 1986 Rules, a registered firm that receives client money must keep it in a separate client account and may not accept client money at all without professional indemnity and fidelity guarantee cover (Rule 57). By keeping the agency out of the money flow, the system records evidence — who holds the deposit, the receipt reference and the date — without taking on a licence obligation the agency does not need. This is also why every letter states the holder explicitly.