Security & data — broker FAQ

Last updated: 31 May 2026

Your clients hand over real financial information when they use your calculators, so you'll want to know it's looked after. These are plain-English answers to the questions brokers ask us most — and each one reflects how the platform actually works today, not an aspiration. For the technical detail and our list of infrastructure providers, see the Trust & Security page and Privacy Policy.

🇦🇺Where is my clients' information stored?

In a database hosted in Sydney, Australia, run on independently-certified infrastructure. Your primary data stays onshore. A small number of supporting services (for example, the provider that sends notification emails) may process limited data overseas; these are listed in our Privacy Policy.

🔒Could another broker ever see my leads?

No. Every lead is tied to the broker who captured it, and the database enforces that boundary at the row level — so a request can only ever return your rows, even if someone tried to ask for more. The public, anonymous key used by the calculators cannot read lead data at all; it can only submit a new enquiry. Tenant isolation is the single most important protection on a shared platform, and it's enforced by the database, not just the application.

👤The founder is a practising broker — can he see my leads?

Fair question, and an important one — LSbroker was built by a practising mortgage broker. The answer is no. The owner/admin view is deliberately built to show only anonymised, aggregate figures — totals and counts used to run the business — and it cannot display any client's name, email, phone, notes or calculator results. We don't look at individual brokers' client records to run the company, and your leads sit behind the very same row-level isolation that stops other brokers seeing them. As with any hosted platform, a strictly limited number of people hold the infrastructure access needed to operate and support the service — that access is restricted, used only to keep the platform running or to help you when you ask, and governed by our privacy obligations. The product is built so the day-to-day running of LSbroker never requires anyone to look at your clients' personal information. As a broker myself, I wouldn't accept anything less for my own book.

✉️Are lead details ever sent in an email?

No — and this is deliberate. When a lead comes in, you get a short notification email that tells you an enquiry has arrived and links you to your dashboard. It does not contain the enquirer's contact details, income, loan figures, or any calculator results. Those live only inside your secure, login-protected dashboard. Email is convenient but it lingers in inboxes, forwards and mail servers indefinitely, so we keep personal information out of it entirely. It's a deliberate trade of a little convenience for a much smaller exposure.

📄Do you copy my leads to Google Sheets or anywhere else?

No. There is no spreadsheet export and no third-party sync. Your leads stay in your dashboard, which is the single source of truth. If you want a copy for your own records, you can export your leads to a CSV file yourself, on demand, from the dashboard — that puts you in control of where any copy goes, rather than us pushing data out automatically.

🛡️How is my account protected?

Access is by email and password, with two-factor authentication (2FA) available using an authenticator app. Sensitive areas of the dashboard require that second factor, so even if a password were guessed or reused from another breached site, lead data stays protected. We recommend every broker turns 2FA on.

🔐Is the connection encrypted?

Yes. Every page and calculator is served over HTTPS, so data is encrypted in transit between the browser and our servers. Stored data is encrypted at rest by our database provider.

👥Who at LSbroker can see my data, and do you sell it?

We never sell or share your data, and we don't use your clients' information for anything other than running the service for you. Internal access is limited to what's needed to operate and support the platform. Your leads are yours.

🗂️How long do you keep data, and can I get it deleted?

Your data is yours for as long as your account is active, and you can export it at any time. If you want leads or your whole account deleted, email us and we'll action it. We're also building self-serve retention controls so you can set data to expire automatically — the less that's kept, the smaller any exposure, which is good practice and an obligation under the Australian Privacy Principles.

💳What about payment details?

Subscription billing is handled by Stripe, a PCI-DSS Level 1 payment provider. We never see or store full card numbers — your card details go straight to Stripe.

🚨What happens if there's a data breach?

We operate under the Notifiable Data Breaches (NDB) scheme of the Privacy Act 1988 (Cth). If an eligible breach affecting personal information occurred, we are committed to notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

✅Is the platform independently audited?

The infrastructure LSbroker is built on — our database/hosting provider, application host, and payment processor — holds independent security certifications (such as SOC 2 and ISO 27001), which you can verify in their own published documentation linked from our Trust & Security page. We're a focused Australian platform, and as we grow we're committed to independent review of our own application layer as well. If you need written assurances for your own compliance, just ask.