Security
Your data, protected and portable
We treat dealership data like the asset it is — encrypted, scoped, audited and always yours. Honest about what we have measured and what we haven’t.
01
Data ownership & row-level access
- Your dealership’s data belongs to your dealership — never sold, never mined, never shared for ads.
- Every record is scoped to its dealership. Dealership A can never read dealership B, even inside the same product.
- Data export, webhooks and an open API shipped in Tier 1 so ownership is practical, not just promised.
02
Encryption: AES-256 at rest, TLS in transit
- Data at rest is encrypted with AES-256.
- All traffic is TLS 1.2+ (in transit).
- Secrets and keys never ship in the browser or the marketing site.
03
Access control: RBAC, MFA, no impersonation
- Role-based access per dealership, with least-privilege defaults.
- Multi-factor authentication available for dealership accounts.
- Support cannot impersonate a dealership — access is audit-logged and role-scoped.
04
Audit trail
- Actions that change records are logged with who, what and when.
- An immutable, dealership-scoped audit trail is surfaced under Settings → Audit (shipped, Tier 1).
05
Data lifecycle
- Records live for as long as your dealership needs them — nothing is quietly purged.
- 10-year retention exports and a compliance document pack shipped in Tier 1 (Settings → Retention).
- Deletion is explicit and exportable first.
06
Availability
- The product runs on a managed cloud backend with automated backups and redundancy.
- We will publish measured availability and specific RPO/RTO commitments alongside billing launch — we don’t invent “99.99%” numbers we can’t back yet.
07
Vulnerability management
- Dependency scanning and builds in CI.
- Dependabot-style updates applied as part of our release loop.
- A responsible-disclosure contact is listed on the Trust page.
08
Breach response
- If a breach affects dealership data, we notify affected dealers without undue delay.
- Our breach commitment is spelled out on the Trust page — no fine print.
09
Compliance-aligned statement
- We describe our controls as “SOC 2-aligned” — the certification work is in progress, and we’ll say “SOC 2” the day the report is real.
- Privacy and compliance posture: see /compliance for the Canadian context and /trust for the data processing agreement.
Security you can read, not decode
Seven days free. Your data stays yours — exportable, always.