How we protect your dealership’s data and your customers’ information.
Your dealership trusts us with driver licences, credit applications, social security numbers and payment details. This page describes, plainly, how that information is handled.
Separation is enforced at the database level through row-level security, not merely in application code. A dealership identifier is never accepted from a browser request — it is derived from the authenticated session. There is no query a signed-in user can construct that returns another dealership’s records.
All traffic is encrypted in transit using TLS. Sensitive fields are encrypted at rest. Credentials and API keys are held in Microsoft Azure Key Vault and are never stored in source code or configuration files.
Card details are collected and stored by Stripe, a PCI-DSS Level 1 service provider. Card numbers never reach our servers, and we could not disclose them if compelled to, because we do not hold them.
Access to sensitive actions — signing a document, viewing a credit application, releasing a payout — is gated by one-time codes delivered by SMS or email. Signature envelopes carry a timestamped audit certificate recording who signed, when, and from what network address.
Driver licences captured during a purchase order or a credit application are encrypted, access-logged, and purged on a retention schedule. Every view and every download of a consumer’s application is recorded against the user who performed it.
Credit applications are handled in line with the Gramm-Leach-Bliley Act Safeguards Rule. Our practices are documented, including access controls, encryption, audit logging, retention limits, and the disclosures required by the Equal Credit Opportunity Act (Regulation B) and the Fair Credit Reporting Act where applicable. Electronic signatures follow ESIGN and UETA requirements.
Our engineering practice is aligned to NIST Cybersecurity Framework 2.0 and NIST SP 800-53 control families for access control, system protection, configuration management and system integrity, and to the OWASP Top 10 for application security — parameterised database access, output escaping, authenticated access at every endpoint, and no user-supplied URL fetched server-side.
An honest note on what this means. Alignment to a framework is a statement of engineering practice, not a certification. We are not SOC 2 certified and do not claim to be. Where your lender or your insurer requires a formal attestation, an accredited assessment is the correct instrument and we will tell you so rather than point at this page.
Every change is deployed with a timestamped rollback artefact taken before the change is applied, and verified after deployment before the work is considered done. Database migrations run transactionally. This is why our releases are boring, which is the intention.
The platform is hosted on Microsoft Azure in United States regions. Documents and photographs are held in encrypted cloud storage.
If you believe you have found a security issue, email support@dealersautocenter.com with the subject line SECURITY. We will acknowledge your report, and we will not pursue action against researchers who report in good faith and do not access or destroy other dealerships’ data.