Protect MLS data by building a written, risk-based security program around the full data lifecycle: approve access through the local MLS, limit each account to its authorized purpose, protect information in storage and transit, monitor use, and plan for incidents and secure disposal. RESO provides data standards and certification—not MLS data or credentials—and neither RESO standards nor general NAR guidance replaces the rules, contracts, and laws that apply to your organization.
Start with a written MLS data security program
Before choosing technical settings, map the information your organization holds and how it moves. NAR’s Data Security & Privacy Toolkit recommends taking inventory of the information collected, who can access it, how it is collected, and whether users may opt out. Apply that exercise to MLS records and related personal information across the systems and workflows your organization controls.
As an Amazon Associate I earn from qualifying purchases.
- Identify information held, its purpose, where it is stored, and how long it is needed.
- Map its movement through MLS API connections, exports, staff devices, vendor systems, backups, and printed records.
- List the people, services, and vendors with access, and the business purpose for each access path.
- Reduce collection and retention of information that is not needed, then dispose of it so it cannot be read or reconstructed.
- Document safeguards, responsibilities, access reviews, incident handling, vendor expectations, and secure disposal practices.
The NAR toolkit, last updated in April 2022, says, “There is no one-size-fits-all approach to security and compliance.” It also describes itself as a guide for creating an organization’s own policies, not comprehensive or authoritative legal advice. Use it as general guidance, then check the current obligations that apply to your MLS and organization.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallControl access through the local MLS
Obtain credentials from the authorized MLS channel
RESO says a data recipient obtains Web API access through the local MLS: after agreeing to that MLS’s data-use and licensing policies, the recipient works with the MLS’s software provider or technical staff for credentials and instructions. RESO supplies standards and certification; it does not provide MLS data or credentials. Contacting RESO is therefore not a substitute for the local MLS’s approval and provisioning process.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
NAR’s current MLS Handbook policy on RESO standards says Web API access for participants and subscribers must provide no less data than other methods such as RETS or FTP, and fields present in the RESO Data Dictionary must be delivered in conformance with that standard. Separately, NAR’s MLS Best Practices recommends RESO Web API as the primary data-access method and calls for written feed-request instructions and support contacts. Those Best Practices are voluntary recommendations, not the same thing as the Handbook policy.
Match each identity to an approved role and purpose
Once access is approved, translate the organization’s authorization decisions into actual accounts and permissions. Issue credentials only to approved people and services; scope each identity to its approved purpose and data; protect credentials from disclosure; review access periodically; and revoke it when a user’s role or relationship ends. These are practical security measures, not a universal MLS role matrix prescribed by the reviewed sources.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep access rules for different systems distinct. NAR’s lockbox policy provides a specific access-control example: mobile apps and software used to access a lockbox must have controls allowing only authorized users, and temporary codes must expire within 72 hours or remain under the listing broker’s or agent’s control. That policy concerns lockbox access; it does not define access rules for an MLS database.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect MLS information in storage and transit
Choose safeguards after mapping where information travels and which devices or services handle it. NAR’s April 2022 toolkit includes this language in a sample written security program: “All data stored on laptops or other portable devices shall be encrypted, as well as all records and files transmitted across public networks or wirelessly, to the extent technically feasible.” This is sample-program language to evaluate for your organization, not a universal technical configuration or mandate established for every MLS.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the data-flow inventory to identify where protection needs to be considered, including API connections, downloaded files, portable devices, vendor platforms, backups, and records printed for business use. The appropriate control depends on the system, data, and applicable obligations. The reviewed sources do not prescribe one encryption product, protocol, or architecture for every MLS.
Include vendors and everyday handling
Security does not stop at your own systems. The toolkit recommends investigating vendors’ security practices and setting expectations in service contracts. Define which information a vendor may access, the permitted purpose, how it must be safeguarded, and how security incidents will be communicated. Include staff practices, credential protection, access removal, incident response, and disposal in the program rather than relying on software settings alone.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For physical records, disposal should make the information unreadable and unreconstructable; the toolkit lists shredding as one option. That is a disposal measure, not protection for live digital MLS systems.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMonitor access and keep useful audit evidence
NAR’s sample security program calls for monitoring computer systems for unauthorized use of or access to personal information, and its checklist includes detecting and preventing security-system failures. Monitoring and audit evidence help an organization investigate suspicious activity, but the reviewed NAR materials do not establish a universal MLS log format, mandatory fields, or retention period. Local rules, contracts, applicable law, and system risk may impose additional requirements.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
As an implementation approach, make sure available records can help authorized investigators determine who accessed a system, what action occurred, and when. Avoid placing unnecessary sensitive data in logs, and restrict access to the logs themselves. Decide what evidence is useful for your systems and how long to retain it based on the requirements that actually apply; do not assume one retention schedule fits every MLS.
Prepare for incidents before one occurs
Set out who will assess a suspected compromise, preserve relevant evidence, contain access, coordinate with service providers, and decide whether notification is required. NAR’s toolkit emphasizes planning ahead and notes that breach-notification requirements vary by state, including who must be notified and the timing, format, and content of notice. Determine the laws applicable to your organization rather than assuming that one state’s process applies everywhere.
Document the technical and operational steps in an incident plan, including how to contact the MLS or relevant vendor. Review the plan as systems, vendors, access arrangements, and applicable requirements change.
Separate standards, policy, recommendations, and local obligations
| Source or rule set | What it establishes | What not to infer |
|---|---|---|
| Local MLS licensing and access process | The recipient works through the local MLS and its software provider or technical staff for approval, credentials, and instructions. | RESO does not issue the local MLS’s credentials or provide its data. |
| NAR MLS Handbook policy on RESO standards | The reviewed policy says Web API access for participants and subscribers must provide no less data than other methods such as RETS or FTP, with applicable Data Dictionary fields delivered in conformance with that standard. | Do not conflate this policy with every voluntary implementation recommendation. |
| NAR MLS Best Practices | Recommends Web API as the primary data-access method, written feed-request instructions, and support contacts. | The page describes these as voluntary practices. |
| NAR Data Security & Privacy Toolkit sample program | Provides general guidance and sample language on safeguards including encryption, monitoring, vendor practices, and incident planning. | It is not a universal technical configuration or comprehensive legal authority. |
| Local rules, contracts, and applicable law | May add requirements for access, security, logging, retention, or breach response. | RESO standards and general NAR guidance do not replace checking the requirements that apply to your organization. |
The NAR Handbook pages reviewed are dated January 1, 2026. RESO’s certification page reported certification versions and data updated October 2, 2026. Policy wording, certification status, local MLS rules, and applicable law can change, so verify current requirements when making operational decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
