One agency can never see another's data
Every agency on Agent Legend is a separate tenant. Isolation is enforced twice over — once in every query the product runs, and again by the database underneath — so one mechanism failing does not become a breach of your data.
Every query the product runs names your agency explicitly, and every table carrying customer data also has row-level security enabled and forced in Postgres. Two mechanisms, deliberately, because security that rests on a single control is one surprise away from failing.
We run two agencies against a live database and check that neither can reach a single row of the other's — not by list, not by search, and not by guessing the ID of a record. A test that only proves the happy path proves nothing.
The system checks its own database-level enforcement at run time and raises an alarm if it ever stops being applied, rather than failing quietly.
Production, staging and development are fully isolated, with separate databases and separate secrets. Customer data never appears in a test environment.
Your data is stored and processed in the UK. We will tell you before that ever changes.
Export it whenever you like. We never train shared AI models on your agency's conversations, contacts or transactions.
Six rules Al cannot break
These are not policies in a document. They are constraints in the product, and they are the reason an agency can let Al speak to its clients.
It never pretends to be human
Every conversation opens by identifying Al as your agency's AI assistant, and a person is always one tap away.
It never guesses
Answers come only from facts you have verified. Anything unknown becomes an honest “I'll find out” and a task for your team.
It never invents pressure
No phantom competing offers. No manufactured urgency. No claims about a property that aren't on file.
Every offer reaches the vendor
Captured verbatim, relayed promptly, confirmed in writing to both sides — a legal duty, delivered mechanically.
Outreach stays lawful
Vendor canvassing by post only, with the required disclosures built into the template and opt-outs honoured permanently.
People own the judgement
Complaints, negotiations and anything sensitive route to a human immediately, with the full conversation attached.
You decide how much Al does on its own
Every agency sets its own automation level, per action type, and can change it at any moment. Start with Al drafting and your team approving. Move to out-of-hours autonomy. Go further when you're ready — or pull it back instantly if you're not.
The obligations we build around
UK estate agency is heavily regulated, and an automated system has to respect every one of those rules by design. These are the frameworks that shape the product.
| Framework | How Agent Legend addresses it |
|---|---|
| UK GDPR & Data Protection Act | Lawful-basis records, data minimisation, configurable retention, subject-access export and deletion, and a processor register. Your data stays in the UK. |
| PECR (marketing) | Vendor prospecting is postal-only by design. There is no code path that emails or texts a prospect who hasn't opted in. |
| TPO Code of Practice | Canvassing templates carry the required disclosures and sender identity; suppression is permanent and honoured before every send. |
| Consumer protection (DMCCA) | Al answers only from verified material information, and never makes a claim that isn't on file. Conversations are logged in full for review. |
| Estate Agents Act 1979 | Every offer is captured verbatim and relayed to the vendor promptly with written confirmation to both parties. This cannot be switched off. |
| Money laundering regulations | Compliance checks gate the memorandum and the handover into progression; records are retained for the statutory period. |
| Automated decision-making | Buyer prioritisation is advisory only. No buyer is ever refused a viewing by an automated decision — anything negative routes to a human. |
Agent Legend provides transaction coordination and administrative automation. It is not a solicitor, conveyancer or financial adviser, and it does not give legal advice. Independent security testing and formal certification are part of our published roadmap; we will state exactly what we hold and when, and never imply otherwise.
Due diligence questions?
We'll answer them in writing, in detail, before you commit to anything.
Talk to us