Skip to the content
Report a repair

Security

Where your data lives, and who can see it.

Agencies trust Evenside with their tenants’ details. Here’s where those details are kept, who handles them, what each person sees, and the record of who did what. How long we keep things, and everyone’s rights, are in the privacy policy.

Kept in Sydney, Australia.

Repairs, photos, documents and accounts are kept in Sydney. Some information passes through providers overseas, or sits in their logs, the same ones our privacy policy names.

Who handles it

  • Supabase keeps our database, sign-ins and the photos and documents people add, in its Sydney region, in Australia. Its logs of sign-ins and requests are kept in Europe.
  • Cloudflare hosts our website and apps, runs our servers and passes replies by email on to us, on its network of data centres around the world. It’s based in the United States, and keeps what it stores mainly there and in Europe.
  • Amazon Web Services sends our emails, and keeps a backup of the photos and documents people add, in its Sydney region, in Australia.
  • Sentry keeps error reports from our servers, and from the apps of people who turn them on, in Frankfurt, Germany.
  • Stripe takes payment for our invoices, and keeps the card an agency adds, with the email of the admin who adds it, in the United States, and may pass them to its own providers in India and Europe.

So information may go to the United States, India, Germany and other countries in Europe, and Cloudflare may carry it through other countries where it has data centres.

No AI reads your repairsNothing anyone writes in Evenside is sent to an AI service.

Card details never reach usPaying by card happens on our payment provider’s own pages.

Who sees what

Each side sees its part, and nothing more.

  • Tenants

    Their own repairs and rentals, and what happens next with each one.

  • Your team

    Your agency’s repairs, homes, tradies and owners, and never another agency’s.

  • Tradies

    The job, the address, how to get in and what you choose to share, from a link for that job.

    Never the tenant’s phone or email

  • Owners

    The quote, how the repair is going and what you choose to share, from a link for that repair.

    Never the tenant’s phone or email

Each agency is walled off from every other in the database itself, not just in the apps, and hundreds of tests check who gets turned away on every change to Evenside.

The record

Who did what, in a record that can’t be changed.

The database writes it as things happen, and only your agency’s admins can see it.

  • Every action that mattersWho was given access and who lost it, links sent, opened and turned off, quotes and invoices decided, what was shared, and changes to your settings.
  • Never anyone’s personal detailsEach entry holds what happened and when, with ids in place of names. The database refuses one with a name, an email or anything someone wrote.
  • Sealed, one entry to the nextNobody can edit or delete an entry. Each carries a fingerprint of the one before it, so a change anywhere would show when the record is checked.
  • Yours to checkYour admins can check the whole record in their own browser, without taking our word for it, and download a copy for your auditor to compare with later.
Getting in

Codes, links and what keeps them safe.

  • Tenants and your team sign in with a code sent by email, which works once and only for 15 minutes. There’s no password to leak or reuse.
  • Your admins choose how long a sign-in lasts for your team, 12 hours, 7 days or 30 days, with a week to start with. After that, everyone signs in again.
  • Tradies and owners get a link for one job, with nothing to install and no account. It stops working after 14 to 30 days, or as soon as a newer one is sent or your office turns it off.
  • We keep only a fingerprint of each link, so even a copy of our database couldn’t be turned back into links that work.
  • Your information is encrypted on its way to and from Evenside, and our database and files are encrypted where they’re kept.
  • The website and apps only run their own code, which keeps out scripts from anywhere else.
  • Updates sent to your own systems are signed, so they can check each one came from Evenside, and they never carry the tenant’s details.
  • Error reports leave out emails, phone numbers and links, and nothing records anyone’s screen. From a phone or computer, they’re off unless the person turns them on.
  • Links are let go 90 days after they stop working, and our notes of the emails we send after 30 days.
Our own rules

When we look, and if something goes wrong.

  • We look only when you askWe look at your agency’s information only to fix something you’ve asked about, and each look goes in your record, so your admins can see when and why. The only other times are to check a suspected data breach, or when the law requires it.
  • A plan for a data breachIf your information may have been seen by someone who shouldn’t have it, we’ll tell you within a day. If it’s likely to cause anyone serious harm, we’ll tell them and the Office of the Australian Information Commissioner, as the law requires.

Both are written down, and your IT team can ask us for a copy.

What isn’t done yet

Evenside is new, so here’s what’s still to come. This page will change as each one does.

  • Evenside doesn’t hold an ISO 27001 or SOC 2 certificate yet. They’re the standards we’re working towards.
  • We haven’t had an independent security test yet.
  • Your team signs in with a code by email. Two-step sign-in and single sign-on aren’t available yet.

Questions from your IT team?

Write to hello@evenside.com.au and we’ll answer them. If you’ve found a security problem, tell us there too, and keep it private until it’s fixed. We treat every security report as urgent, and aim to reply within 2 business days.

Email us