An estate agency holds a lot of sensitive information: clients' phone numbers and e-mail addresses, what people can afford, owners' details, notes from difficult negotiations. Clients trust you with it, and losing it, or letting it reach the wrong person, damages that trust quickly.

Good security is a mix of the right tools and a few everyday habits. Here is what EstateCRM does to protect your agency's data, and what your team can do alongside it.

Two-step sign-in, for one person or the whole office

Passwords get reused, guessed and phished. Two-step sign-in adds a second check. After the password, EstateCRM asks for a 6-digit code from an authenticator app on the person's phone, so a stolen password alone isn't enough to get in.

Each person turns it on under My profile, scans a QR code and saves 8 recovery codes for the day they lose their phone. Owners don't have to rely on everyone remembering. In the agency's security settings, the owner can require two-step sign-in for everyone in the agency.

Agents see their own clients unless you decide otherwise

Not everyone needs to see everything. In EstateCRM, people with the Agent role see only the contacts assigned to them. Owners and managers see all contacts, and if your agents share their clients, you can give them the Assistant role instead.

The sidebar shows each person only the pages they can use, and every rule is checked on the server, so hiding a button is never the only protection. Billing and the agency settings stay with the owner.

When someone leaves, you deactivate them from the team page. They are signed out at once, and their listings, contacts and history stay with the agency.

A record of every change

Changes to listings, contacts and requirements are logged with the old and new value, who made them and when. If a price or a phone number changes unexpectedly, you can see exactly what happened. It is also a quiet deterrent, because people are more careful when changes are visible.

Each agency's data is separated in the database itself as well as in the app, and connections to EstateCRM are encrypted.

Daily backups and a full export whenever you want

EstateCRM is backed up daily, so a technical failure doesn't mean lost work.

Your data also stays yours. The agency owner can download a full copy at any time, including after a subscription has ended. The export is prepared in the background and arrives as a ZIP file with a spreadsheet for each kind of record, such as contacts, requirements, listings, activities, deals, enquiries and the change history, plus a list of every photo and document with a download link. Passwords and security keys are never included.

If an agency's access ends, its data is kept for 30 days, and the owner is warned by e-mail before the date. After that it is deleted for good.

Good security habits for agencies

Tools only go so far. These habits close most of the remaining gaps:

  • Require two-step sign-in for the whole agency and set it up on a new colleague's first day.
  • Give the smallest role that works. Start new people as agents and widen access when there is a reason.
  • Deactivate leavers on their last day, not a month later when someone remembers.
  • Never share a sign-in. Everyone gets their own account, so the change history stays meaningful.
  • Keep client details inside the CRM, not in personal spreadsheets or chat groups on private phones.
  • Lock phones and laptops, and sign out on shared office computers.
  • Treat requests for codes with suspicion. Nobody from your team or your software provider needs your one-time code.
  • Store recovery codes somewhere safe and separate from the phone they back up.
  • Download an export now and then, so you know what your data looks like and where it is.

The strongest settings don't help if one shared password sits on a sticky note. Talk about these habits at a team meeting, write them into your onboarding checklist, and review who has access every few months. It takes little time and saves a great deal of trouble.

Clients rarely ask how you protect their details, but they notice when something goes wrong. Getting the basics right is part of being an agency people trust.

Talk to us about your set-up

If you would like to see how roles, two-step sign-in and the data export work for a team like yours, book a demo at estatecrm.cy.