What is AI in lettings and estate agency?

AI in lettings and estate agency refers to software that automates tasks like answering enquiries, booking viewings, handling maintenance requests, and managing compliance so agents can focus on higher-value work.

Does AI replace letting agents?

No. AI like Felicity handles repetitive tasks so letting agents can focus on relationships, negotiations, and decisions that require human judgement. It works alongside your team, not instead of it.

How does AI handle maintenance requests?

Felicity captures maintenance requests via phone, email, or WhatsApp, triages them based on urgency, gathers information needed from tenants, and triggers the appropriate workflow including contacting contractors and updating landlords.

What guardrails does Felicity have?

Felicity operates within rules set by your agency. It only takes actions you have pre-approved, escalates anything outside its scope to your team, and never makes commitments it is not authorised to make.

Do tenants know they are speaking to AI?

Yes. Felicity is transparent about being an AI assistant. Tenants are informed they are interacting with an automated system, and can always be escalated to a human member of your team.

Security Measures
and Sub-Processors

As incorporated into LightWork’s Data Processing Agreement

Annex 1: Security measures

Technical and organisational
measures to ensure the
security of Personal Data

Technical measures

All workloads run on Google Cloud Platform (GCP), deployed strictly in UK and EU regions (London or other EU zones only).
MongoDB (UK region) is our primary database. Data is encrypted at rest with AES-256 and encrypted in transit (TLS).
We maintain periodic automated backups of all production databases with secure storage and controlled access.
Access to infrastructure is restricted via IAM, MFA-enforced accounts and least-privilege roles.
Services run in private networks with firewalls and VPC-level isolation.
Monitoring, alerting and log management are handled by Datadog, configured within EU regions.
We use Vanta to continuously monitor our security position and maintain compliance with ISO27001:2022 and SOC2 frameworks.
All software is kept up-to-date and security updates are installed as soon as reasonably possible.

Organisational measures

Operational practices include regular patching, vulnerability scanning, penetration testing and maintaining incident management and response processes.
Making all employees and third-party agents fully aware of their individual responsibilities under the UK GDPR.

Annex 2: Sub-processors

Current sub-processors

Name of Sub-processor	Location of Processing	Transfer mechanism
Google Cloud Platform (GCP): cloud infrastructure	UK and EEA (US access)	EU-US DPF (UK Extension) for US support/admin access; SCCs + UK Addendum fallback
MongoDB Atlas: primary database	UK (US access)	EU-US DPF (UK Extension)
Redis Cloud: caching	UK (US access)	SCCs + UK Addendum; TRA completed
Nylas: email and calendar integration	EEA (US access)	Adequacy (EEA); EU-US DPF (UK Extension) for US access
Anthropic (Claude): foundational model provider	US	SCCs + UK Addendum; TRA completed
SendGrid (Twilio): outbound transactional email	US	SCCs + UK Addendum + TRA completed
Resend: outbound transactional email	US	EU-US DPF (UK Extension)
Twilio: voice, SMS and WhatsApp communications	EEA / US	EU-US DPF (UK Extension)
ElevenLabs: text-to-speech / voice	US	EU-US DPF + SCCs (UK Addendum)
Google Maps Platform: travel-time and viewing logistics	US	EU-US DPF (UK Extension)
Datadog: monitoring, logging and observability	EEA (US access)	Adequacy (EEA); EU-US DPF (UK Extension) for US access
PostHog: product analytics	EEA (US access)	Adequacy (EEA); EU-US DPF (UK Extension) for US access
Pydantic Logfire: application and LLM observability	EEA (US access)	Adequacy (EEA); SCCs + UK Addendum for US access; TRA completed
Pylon: customer support desk	US	SCCs (Module 2) + UK Addendum; TRA completed
Vercel: application hosting for the Spark demo (select clients)	US	EU-US DPF (UK Extension); EU SCCs + UK Addendum (IDTA) fallback
Slack: internal comms; incidental customer data in QA/support	US	EU-US DPF (UK Extension) via Salesforce

Sub-processor change notification terms

We give customers 30 days' advance notice of a new or changed sub-processor, and 48 hours for an urgent replacement (e.g. a security issue).

Retained but not in live production

Name of Sub-processor	Location of Processing	Transfer mechanism
OpenAI: foundational model provider	US	SCCs + UK Addendum; TRA completed
Google (Gemini): foundational model provider	US	EU-US DPF (UK Extension)

Version	Date	Description	Author	Approved By
1.0	25 March 2026	Security Measures and Sub-Processors	James Wilson	Rameen Sorkhabi
1.1	25 June 2026	Updated sub-processor list and transfer mechanisms.	Freddie Poser	Freddie Poser
1.2	28 July 2026	Reconciled to internal register: removed Qdrant and LangSmith (decommissioned); moved OpenAI and Gemini to retained (not in live production); added Pylon, Vercel and Slack; GCP US-access leg annotated.	James Wilson	Freddie Poser