Does discovery scrape listing portals?

No. A portal's listings are not licensed to this platform, so they stay in the source registry marked refused with the reason recorded. The licence check throws at ingestion, so an unlicensed source is never read in the first place.

What if a property's owner email isn't published anywhere?

Then there is no email. A contact detail is extracted from a source that published it or it does not exist — no code path assembles one from a name and a pattern, because guessing an address is manufacturing data, not collecting it.

Why route everything through a single fetcher?

Because a second outbound path is the one that skips the checks. One door means the licence, host, robots.txt and rate-limit checks are not a policy to remember but the only way a request can reach the network at all.

Sourcing leads from licensed data, without scraping

2026-10-20·4 min read

Discovery finds motivated-seller signals from sources that carry a recorded licence, and from nowhere else. Every request goes through one outbound path that checks the licence, the host allowlist, robots.txt and a rate limit before fetching, and treats a 401, 403 or 429 as an answer. A contact detail is extracted from the source or it does not exist — a guessed email address is invention, not collection, and no code path builds one.

The property-sourcing industry runs largely on scraping: pull data from wherever it sits, guess the gaps, and worry about the licence never. It is fast, it is cheap, and it manufactures a liability with every record — because the exposure is created at the moment data is taken, not at the moment it is shown. Discovery here is built the opposite way, and the constraint is the product.

What does 'licensed first' actually mean?

That no source is read without a recorded licence, full stop. Price Paid Data and the EPC register are read because they are published under open licences whose terms are recorded; a portal's listings are not, so they stay in the registry marked refused, with the reason written down. The licence check throws at ingestion rather than at display, because a dataset read without a licence is a problem the moment it is in hand — displaying it later is not what created the exposure.

What the single outbound path checks before any fetch

Licence: A recorded licence for this source, or no request
Host allowlist: A known host over HTTPS, with no credentials in the URL
robots.txt: Parsed and obeyed — a disallow is a disallow
Rate limit: Bounded, so the source is never hammered
401 / 403 / 429: Treated as an answer — the source has said no

Why is there only one outbound path?

Because a second one is a hole. Every discovery request goes through a single fetcher that applies all of those checks in order, and there is deliberately no other way out to the network. A codebase with two outbound paths has one that enforces the rules and one that somebody added in a hurry, and the one added in a hurry is the one that scrapes. One path means the rules are not a policy to remember — they are the only door.

What about a contact detail that isn't published?

It does not exist. A contact detail is extracted from a source that published it, or there is no contact detail — there is no code path that assembles one from a name and a company and a common email pattern, and there must never be one. Guessing an address is not collecting data, it is manufacturing it, and manufactured contact data is both wrong often and unlawful to use. A named individual's mailbox found where it should not have been is recorded as rejected, with the reason, rather than kept.

The downstream rules reinforce this. Emailing a named individual without consent has no legitimate-interests route under the electronic-marketing rules, so an email address, even a correct one, does not entitle anyone to use it. Discovery surfaces a signal and a lawful route to act on it; it never invents the person at the other end.

And a signal is only ever a beginning. A discovered property is not a deal — it is a candidate that still has to pass Seller Protection, carry its material information, and survive customer due diligence on whoever turns out to be behind it. Discovery narrows a town to a list worth looking at from licensed data; it does not decide anything, and treating a derived signal as a decision is how a sourcing business acquires a portfolio nobody wanted for a reason.

What it changes

Every record carries a licence, so the data is usable rather than a liability in waiting.
A refused source is recorded as refused, with the reason — not quietly scraped anyway.
robots.txt and a 403 are treated as answers, because a source that said no has said no.
A contact detail is extracted or it does not exist, so nothing rests on a guessed address.

Scraping is faster right up until it is not — until a licence, a regulator or a complaint turns the whole dataset into a problem. Reading only what is licensed, through one door that obeys the source, is slower to build and the only version that is still standing in a year.

Common questions

Does discovery scrape listing portals?: No. A portal's listings are not licensed to this platform, so they stay in the source registry marked refused with the reason recorded. The licence check throws at ingestion, so an unlicensed source is never read in the first place.
What if a property's owner email isn't published anywhere?: Then there is no email. A contact detail is extracted from a source that published it or it does not exist — no code path assembles one from a name and a pattern, because guessing an address is manufacturing data, not collecting it.
Why route everything through a single fetcher?: Because a second outbound path is the one that skips the checks. One door means the licence, host, robots.txt and rate-limit checks are not a policy to remember but the only way a request can reach the network at all.

Sources

Price Paid Data
Every registered residential sale in England and Wales since 1995. Published by HM Land Registry; the link goes to their site rather than to the document, because a deep link into guidance is a slug that changes without notice.
Energy Performance of Buildings Register
Every certificate lodged, with floor area, construction age band and the assessor's date. Published by Department for Energy Security and Net Zero; the link goes to their site rather than to the document, because a deep link into guidance is a slug that changes without notice.
Data Protection Act 2018
UK GDPR as it applies here, including special-category data. Published by legislation.gov.uk.
Privacy and Electronic Communications (EC Directive) Regulations 2003, reg. 22
Unsolicited electronic mail may not be sent to an individual subscriber without their consent. There is no legitimate-interests route. Published by legislation.gov.uk.

Terms used on this page

seller protection: Checks that can stop a transaction outright where a seller may not be able to give free and informed consent.
Price Paid Data: Every registered property sale in England and Wales since 1995, published free under the Open Government Licence.
EPC register: The public register of energy performance certificates, which also publishes floor area and lodgement dates.
material information: The facts that must be published about a property before it is marketed, in three parts, with unanswered treated as an answer.
customer due diligence: Identifying and verifying who you are transacting with, and who is behind them, before the transaction proceeds.