A regional WA real estate property rental agency exposed sensitive data when an unmapped database folder containing rental applicant financial statements and driver's licence files sat open to public web indexing for 21 months.