// Trust & Security Report
Follow Up Boss (a brand of Zillow, Inc.)
Real Estate CRM and AI Platform
Certifications held
6
Maturity
Enterprise
Trains on your data
Yes
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on followupboss.com“Follow up Boss follows the most reputable security standards on the market, and has the accreditations and audits to prove it. SOC 2 Type 2”
Verify on followupboss.com“We complete annual audits which confirm our high security standards. Click here to view our latest SOC-3 report.”
Verify on followupboss.com“Follow up Boss follows the most reputable security standards on the market, and has the accreditations and audits to prove it. CASA Tier 2”
Verify on followupboss.com“With PCI-compliant networks, your billing information is in safe hands.”
Verify on followupboss.com“Follow up Boss follows the most reputable security standards on the market, and has the accreditations and audits to prove it. CCPA”
> Show 2 unconfirmed / not-held certifications
source: followupboss.comDo not upload or share any of the following types of information through the Services: Personal health or financial information subject to HIPAA
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Not stated
Data region
Not disclosed. Vendor states 'leading cloud platform technologies' without naming the provider or geographic region. Presumed US-based given Zillow Group infrastructure.
Terms of Service (Section 6.5) explicitly authorize Zillow to use Customer Data for AI/ML Activities including designing, developing, pre-training, training, fine-tuning, and evaluating ML systems. A carve-out applies: Agent-Only Customer Data (end customers without a Zillow account) is NOT used for Zillow products other than FUB. However, Mutual Customer Data (end customers who also have a Zillow account) is subject to Zillow's full Privacy Notice with fewer restrictions. The AI features page states 'it is not used to train global AI models or any external systems,' which partially softens but does not override the broad ToS grant. Internal training for FUB service improvement is permitted and likely occurs.
// Security controls
Encryption
256-bit AES encryption; HTTPS enforced for all connections (data at rest and in transit)
followupboss.comBackup and recovery
Continuous backups every second, retained for 35 days across multiple redundant data centers
followupboss.comSecurity audits
Annual Google security audits plus independent third-party assessments. SOC 3 report publicly available, latest dated October 31, 2024.
followupboss.comBug bounty and vulnerability disclosure
No formal bug bounty (no HackerOne or Bugcrowd program). Email-based Vulnerability Disclosure Policy only: reports to security@followupboss.com, 2-business-day response commitment, 90-day patch target, no monetary reward, PGP encryption supported.
followupboss.comData segmentation
Customer production data is segmented; customers control and can revoke integration partner access at any time
followupboss.comPenetration testing
Not explicitly mentioned. Annual Google security audits and independent assessments are referenced but penetration test cadence is not disclosed.
followupboss.com// Products & data scope
data: Lead and contact data, communications (calls, texts, emails), deal tracking, calendar integrations. Governed by FUB Privacy Notice Addendum to Zillow Privacy Notice. Agent-Only Customer Data (end customers without Zillow accounts) has stricter cross-product protections; Mutual Customer Data (end customers who also have Zillow accounts) is shared with Zillow's broader ecosystem.
Core product. Available via Grow ($69/user/month), Pro ($499/month for 10 users), and Platform ($1,000/month for 30 users) subscription tiers. 250+ lead source integrations. Founded 2011, acquired by Zillow Group December 2023.
data: Uses existing CRM data (calls, texts, emails, lead activity) within each customer account. Terms of Service authorize AI/ML training on customer data for service improvement and product development.
Included in all subscription plans at no additional cost. Features include Smart Summaries (call/lead recap), Suggested Tasks, Smart Messages (AI-drafted texts and emails), and Predictive Lead Prioritization (integrates Zillow buyer intent signals). Some features require FUB Calling add-on.
data: Tracks visitor behavior on agent websites; data flows into FUB CRM as lead source data. Subject to same privacy framework.
Tracking pixel for real estate agent and team websites.
data: Call recordings and transcripts processed and stored within the CRM account.
Paid add-on at $39/user/month on Grow plan. Unlimited calling and texting included in Pro and Platform plans.
data: Connects FUB to Zillow's buyer and seller lead network. When an end customer has both a Zillow account and a record in the agent's FUB system ('Mutual Customer'), their data is governed by Zillow's full Privacy Notice, not just the FUB Addendum, enabling Zillow to use that data across its products.
Launched late 2025. Significant industry controversy documented in real estate trade press (HousingWire, Notorious ROB, BAM). Key competitive risk: Zillow gains access to an agent's client data when that client also uses Zillow.
// What to watch
- Zillow ownership creates Mutual Customer Data risk: any FUB end customer who also has a Zillow account has their data governed by Zillow's full Privacy Notice, enabling Zillow to use that data across its own products. This is a significant conflict-of-interest concern for real estate agents competing with Zillow's own buyer-agent business.
- Terms of Service (Section 6.5) explicitly authorize AI/ML training on customer data for new product development. The AI features page says data is 'not used to train global AI models or any external systems,' which softens but does not contractually override the ToS grant. These two statements are in tension.
- No GDPR compliance framework or DPA is publicly documented. The privacy notice is a US-focused Addendum to Zillow's Privacy Notice with no explicit EU data rights beyond California (CCPA).
- Data storage geography is not disclosed. 'Leading cloud platform technologies' provides no actionable compliance information for customers with data residency requirements.
- No formal bug bounty program: email-only Vulnerability Disclosure Policy with no monetary reward and no partnership with HackerOne or Bugcrowd.
- ISO 27001 certification not held and not mentioned.
- HIPAA data is explicitly prohibited from upload: not suitable for any use case involving protected health information.
- Privacy policy change (effective November 15, 2025) attracted significant industry criticism regarding Zillow's expanded access to agent client data. Multiple real estate trade publications documented the controversy.
// At a glance
Pricing model
Subscription-based. Per-user on Grow ($69/user/month); team-based on Pro ($499/month flat for first 10 users, $49/month each additional) and Platform ($1,000/month flat for first 30 users, $20/month each additional). Annual billing saves approximately 16%. No long-term contracts required. 14-day free trial.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Follow Up Boss (a brand of Zillow, Inc.)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
followupboss.com