Security roadmap

Google sign-in

Brokers and admins can continue with Google OAuth alongside email/password. Invite flows prefer one-click Google when the invitee is not yet signed in.

Admin MFA (TOTP)

Brokerage admins enroll an authenticator app. A code is required when adding or deactivating an agent. The rest of the brokerage workspace stays open. Passkeys are next.

SAML SSO

Enterprise brokerages will connect an IdP (Okta, Azure AD, Google Workspace) so agents land in DealMade without managing a separate password.

SCIM provisioning

Automated user lifecycle — create, update, and deactivate brokerage memberships from the customer directory.

Passkeys / WebAuthn MFA

Device-bound passkeys as the preferred second factor for admins, with TOTP retained as a fallback.