Security

• Every page and every upload travels over HTTPS (TLS 1.2 or newer), and browsers are told never to use an unencrypted connection with us.
• Our database, file storage and session store are encrypted at rest. The database is backed up automatically every day, and the backups are encrypted too.
• Your account, your home and your files live in our production system only. Testing uses made-up homes and people, never yours.

• Interior photos are private to you and your agent until you choose to publish them. Nothing is stored where the public can reach it: each view uses a link that expires within minutes.
• We remove location and camera details from the copies we make, and never change your original.
• Every photo is checked for people. A photo showing a person can only be retaken or left out, never published.
• Photos waiting on your phone for a connection are stored encrypted and erased as soon as we confirm they arrived.
• Photos go to an AI service only through one gateway, and only to providers we have approved for interior images. What the AI suggests stays a suggestion until you confirm it.

• Uploads are checked for what they really are. A file that isn't a genuine PDF or photo is refused and deleted.
• Changes to your listing, signatures and every look at an original photo or document are recorded in a history the database won't let anyone edit or delete.
• When an agent approves a listing, the compliance checks it passed are saved with the approval, so the record shows what was checked and when.

• Lockbox codes and access instructions are encrypted separately from everything else.
• Only you, your agent and a confirmed visitor during their showing window can see them, and they're never sent by email. Every time someone views one, it's recorded.

• Card payments are handled by Stripe. We never see or store your full card number.
• We will never send you wiring instructions. Any message that mentions wiring money or account numbers gets a warning, whoever sent it. Before you wire anything, call your title or escrow company at a number you looked up yourself.

• Sellers sign in with a one-time code sent to their email, so there's no password to steal or reuse.
• Your account settings show every device you're signed in on, and you can sign any of them out.
• Besides Get Listed staff and the agents who review listings, only people you invite, like a co-seller, can see your home.

• Only Get Listed staff and the licensed agents who review listings can open a home's records, and administrative tools are limited further, by role.
• Provider keys and passwords live in a secrets manager, never in our code. Our build checks scan the code for leaked secrets and for libraries with known vulnerabilities.
• Our application logs leave out private links, sign-in codes and IP addresses.
• The approval record, the history of each listing and the signed documents are there for the firm's files.

If you think you've found a security problem, please tell us before telling anyone else. Sign in, open Help and choose “Message support”, and say it's about security. Please don't access anyone else's information while you look.