The security checklist franchises ask tech vendors for

When a franchise picks software, it is trusting a vendor with every office's clients. The security review is how it checks that trust before thousands of agents log in.

Franchise and enterprise brokerages ask tech vendors the same questions over and over, usually in a long questionnaire. The questions are not busywork. A franchise's brand sits on every office, and one weak login can expose client files, contracts and money movement. The FBI counted more than $275 million in real estate fraud losses in 2025, as reported by NAR.

Here is the checklist in plain English: what to ask, why it matters and what a good answer sounds like. At the end, we answer it for RealtyMind using only what our own security page says.

1. Sign-in and access

• Single sign-on. Can agents log in with the company account they already use, through your identity provider? Ask which direction it works: does the vendor accept your login, or does it want to be the login?
• Multi-factor sign-in. CISA says using multi-factor authentication makes you 99% less likely to be hacked. Ask whether it is available and whether you can require it.
• Phone apps. Face ID or fingerprint sign-in, so agents are not typing passwords at a showing.
• Day-one offboarding. When an agent leaves, can an admin shut off access at once, everywhere?

2. Roles and data walls

• Roles. What does an agent, team lead, office admin and broker each see?
• Office walls. Is each office's data kept apart from other offices? Can regions and the national team see roll-ups without seeing every client list?
• Brokerage walls. Is each customer's data separated from every other customer's?
• AI follows the same rules. If an AI assistant can look things up, does it check who is asking first?

3. Data ownership and export

• Who owns what. Contacts, deals and files: do they belong to the agent, the office or the franchise? Get it in writing before rollout, not at the first departure.
• Export anytime. In what formats, and who can export what?
• Consent travels. Do opt-outs export with contacts, so the next system keeps honoring them?
• Not for sale. Does the vendor sell or rent your data to anyone?

4. Encryption and backups

• Encrypted in transit and at rest. Data moving between devices and servers, and data stored on servers, including files and backups.
• Automatic backups. How often, and has a restore been tested?

5. Activity logs

Ask whether sign-ins, exports and changes to sensitive records are logged, and whether a broker can see who did what and when. When something goes wrong, the log is how you find out what happened.

6. Audits and certifications

Many franchises ask for an independent audit report. A common one is SOC 2. The AICPA describes its SOC reports as a suite of service offerings CPAs may provide on a service organization's system controls. Ask whether the vendor has one, what period it covers and whether you can read it under a confidentiality agreement. Also ask about outside security testing. Just as important: be wary of a vendor that hints at certifications it cannot show you.

7. AI-specific questions

• Does the AI respect the same roles and data walls as people?
• Are calls recorded, and does the AI say so at the start?
• Does the AI call or text only people who opted in?
• How is client data used by the AI, and can you get that answer in writing?

8. When something goes wrong

Ask how the vendor tells you about a security problem, how fast, and who your contact is. Ask how someone outside reports a security issue to them. A clear answer here says a lot about the rest.

How RealtyMind answers today

Here is our own checklist, answered only from our security page, our franchise page and our help articles. RealtyMind is in private pilot.

That last row on certifications matters. A pilot-stage vendor should tell you plainly what it has and has not earned yet, so you can decide what your rollout needs.

What agents will ask you

The security review is not only for the franchise's IT team. Agents will ask their own version of the same questions, usually in plainer words, and their answers decide whether they actually use the tool:

• "Can my broker see my clients?" Explain the roles in one sentence, and show them.
• "If I leave, do I keep my contacts?" Have the ownership answer ready, in writing, before rollout.
• "Will this text my clients without asking?" Show who approves what, and that only people who opted in get texts.
• "Do I need another password?" With Google or Microsoft sign-in, agents use the work login they already have.

Put these answers in the rollout kit for every office. A clear answer on day one prevents a rumor on day two.

A simple way to run the review

1. Send the questionnaire early, before the demo, so answers shape what you look at.
2. Ask for written answers and links to the vendor's own pages.
3. Test it in a pilot office: sign in with your company login, try each role and run an export.
4. Check offboarding by removing a test agent and confirming access ends.
5. Decide region by region. Our guide to rolling out technology across a franchise covers the rest.

Questions