Follow Up Boss Security Features Explained

Why does CRM security matter for real estate teams?

A real estate CRM holds some of the most sensitive personal data your business touches: full names, phone numbers, email addresses, home-buying budgets, current addresses, and mortgage information. A breach or unauthorized internal access can damage client relationships, create legal exposure, and violate state privacy laws.

Follow Up Boss is owned by Zillow Group and operates at significant scale across real estate brokerages. Understanding its security model helps you make informed decisions about access control, integration setup, and what to look for when adding AI tools to your CRM stack.

What role-based access controls does Follow Up Boss have?

FUB has a tiered permission model. At the top is the Owner role, which has full admin access including billing, integrations, and all contacts. Below that:

• Admin — can manage team members, action plans, smart lists, and CRM settings, but may not have access to billing depending on configuration.
• Agent — sees only the contacts assigned to them (or shared via smart lists), and cannot access account-wide settings.
• Lender / partner — limited view of specific contacts or transactions where they are named collaborators.

Smart lists and lead routing rules further restrict which contacts are visible to which agents. A brokerage with multiple teams can use these controls to enforce data separation — an agent in one team cannot view another team's pipeline unless explicitly shared.

How does Follow Up Boss API authentication work?

The FUB REST API uses HTTP Basic authentication. Your API key goes in the username field; the password field is left empty. The key is sent as a Base64-encoded string in the Authorization header on every request.

Because the API key is account-wide, it should be treated like a password: stored in environment variables, never committed to source control, and rotated if there is any suspicion of exposure. FUB allows you to regenerate your API key from Settings › Integrations › API at any time.

What is OAuth and why does FUB support it?

OAuth 2.0 allows third-party apps to access your FUB data with a scoped, revocable token instead of your account-wide API key. This is meaningfully more secure for two reasons:

• Scope limitation: OAuth tokens can be restricted to specific actions (read contacts, create notes) rather than granting full API access.
• Revocability: You can disconnect the integration from FUB Settings without regenerating your main API key, which would break all other integrations simultaneously.

FUB's OAuth flow follows the standard Authorization Code grant: the third-party app redirects you to a FUB authorization screen, you approve the connection, and FUB returns an access token (and refresh token) to the app. The user never exposes their FUB password to the third party.

What is HMAC signature verification in Follow Up Boss embeds?

Follow Up Boss has an embedded app system that lets third-party tools appear inside the FUB interface. When FUB loads an embedded app for a specific agent, it sends a base64-encoded context string containing the user's identity and account. This context is signed with HMAC-SHA256 using a shared secret known only to FUB and the app developer.

The embedded app verifies the signature before trusting the context. This prevents a malicious actor from forging a context string that impersonates another agent or account. The verification logic is a constant-time comparison — meaning the check takes the same amount of time whether the signature matches or not, which blocks timing-based attacks that could reveal information about valid signatures.

Follow Up Ace uses this verification on every embedded request: the verifyEmbedUser middleware extracts the context, recomputes the HMAC-SHA256 signature, and rejects the request with a 403 if the signatures do not match.

How does two-factor authentication work in Follow Up Boss?

Follow Up Boss supports two-factor authentication (2FA) for admin accounts. When enabled, logging in requires both the account password and a time-based one-time code from an authenticator app. For brokerages with multiple admins or high-value contact databases, enabling 2FA on every admin account is a basic security hygiene step worth requiring at the team level.

Note that 2FA applies to the FUB web interface login. API key access is not gated by 2FA, which is another reason to treat API keys as sensitive credentials and use per-user OAuth where possible.

What about data in transit and at rest?

Follow Up Boss uses HTTPS for all web and API traffic, encrypting data in transit. For specifics on encryption at rest, data residency, compliance attestations, or penetration testing reports, contact the Follow Up Boss security team directly via followupboss.com — those details are outside the scope of this article and may have changed since publication.

How does Follow Up Ace handle security on top of FUB?

Follow Up Ace sits inside the FUB embed frame, so every request goes through HMAC signature verification before any data is accessed or returned. The system has two authentication paths:

• Embed users: Authenticated via the FUB context + HMAC signature. No separate password required — identity is proven by the FUB session.
• Admin users: Authenticated via Firebase Authentication with email and password. Admin access to the dashboard is entirely separate from the agent-facing embed.

For FUB API calls made on behalf of a user, Follow Up Ace prioritizes per-user OAuth tokens over the account-wide API key. If a user has connected their own FUB OAuth credentials, those are used — and if that connection is revoked, the system falls back gracefully rather than silently using the broader key.

The Compliance module adds a Fair Housing layer: every outbound message draft can be scanned by scanForComplianceViolations() before it is sent, flagging language that could create Fair Housing exposure. This is an additional safety layer relevant to brokerages operating under state real estate licensing requirements.

Key security checklist for FUB teams

• Enable 2FA on all admin and owner accounts.
• Use OAuth integrations instead of sharing your main API key with every tool.
• Audit which agents have admin vs. agent roles — the principle of least privilege applies in a CRM just as much as in a server environment.
• Rotate your API key if any team member who had access departs, or if a tool you no longer use still holds it.
• Subscribe to the emEventsUnsubscribed webhook so your email outreach automatically stops when a contact opts out — both a compliance and a trust issue.
• Review smart list sharing settings quarterly; it is easy for lists to accumulate visibility over time.

For a deeper look at how AI tools connect to Follow Up Boss and what data they access, see the Ace Trove page or the Guides section.