Skip to content
  • There are no suggestions because the search field is empty.

Your Data in Sherlok

The security of broker and client data is at the core of everything we do at Sherlok.

 This article explains how we look after your data, what happens if you cancel, and how to ask us to delete it if you still want it removed. For the full security picture, see Data Processing & Security Overview. 

How we look after your data

We host Sherlok in Amazon AWS data centres in Sydney. Sensitive data is replicated across multiple storage locations, backed up daily, and kept in several sites. Infrastructure is routinely updated with the latest security patches.

All data transmitted in and out of Sherlok is encrypted in transit and at rest. Data over public networks uses SSL/TLS. Databases use AES-256. Uploaded files use AES-GCM. Login credentials are hashed with bcrypt (with salting).

We do not use your Sherlok account data for unrelated purposes once you are no longer a customer. Broker and client files stay there to support your lending work, not for us to reuse elsewhere.

If you cancel but leave your data in place, it stays in your account so you are not starting from scratch if you come back. Client files that already consented to share data via CDR remain as an active consent so the client data can be refresh if you return, instead of rebuilding everything. Active consents remain active until the clients have revoked consent or the consent period expires (generally 12 months from the date of consent)

More detail: Data Processing & Security Overview · Privacy Policy

 

Cancel is not the same as delete

Cancelling your Sherlok subscription stops billing and access to the product for you and your clients.

It does not automatically delete the data already in your account.

Many brokers cancel and leave their data stored so it is ready if they return later. That is a valid choice. Your data remains locked, safe and secure to your account under the protections above.



If you still want your data deleted

If you would like Sherlok to delete your account data as well, follow the steps below. We only start deletion once we have your written request.

  1. Email support@sherlok.com.au from the email address on your Sherlok account.
  2. Use a subject line such as: Data deletion request – Sherlok.
  3. Include:
  • Your full name
  • Your brokerage name (if you have one)
  • The email you use to sign in
  • A clear line that you want your Sherlok broker data deleted

If anything is unclear, we will reply and confirm before we start. We want to get this right for you.

 

What happens next

    • We aim to acknowledge your request within 2 business days.
    • Once deletion starts, you will be signed out. Client invite links tied to your account will stop working so no new client files can be created under that account while deletion runs.
    • For most brokers, the live deletion work finishes within about an hour. Accounts with a large history can take a little longer.
    • When deletion is complete, we will email you to confirm.
    • We allow 10 business days to complete the data deletion request

 

 

What we remove

When a deletion request is confirmed, we remove Sherlok data linked to your broker account, including:

      • Applications and related applicant records you collected in Sherlok
      • Uploads and attachments on those files
      • Your Sherlok account settings and broker profile in the product
      • Your broker login on Sherlok (after related records are cleared)

Where a record cannot be fully removed for technical or legal reasons, we remove or de-identify personal details wherever we are allowed to.

 

 

What may stay

A small amount of information may remain where the law requires it, or where it is not Sherlok account data in the same way:

    • Billing records with our payment provider, for as long as the law requires
    • Open banking (CDR) consents sit with Sherlok as the trusted adviser. Only Expired consent data is removed as part of this broker deletion flow. CDR Consents expire within a year of the consent date, or earlier if the consenting customer revokes consent and once the last active consent has expired, the customer CDR data is deleted.
    • Emergency database backups may still hold a copy for up to 7 days until those backups age out

 

Questions

For deletion requests, email support@sherlok.com.au using the subject line and details above so we can action your request without delay.

 

Sherlok Technology Pty Ltd is a credit representative (535299) of QED CREDIT SERVICES PTY LTD, ACN 622 971 402, Credit Licence Number 387856.