How your data is kept separate

Many dealerships use MotoDealerHQ, but each one is a separate, private account. Your inventory, leads, customers, deals, files and settings are only ever available to people you have invited, and to MotoDealerHQ support only when you grant it. This page explains how that works and how you can limit access further inside your own dealership.

How dealerships are kept apart #

• Every request is tied to one dealership. The console works out which dealership you are in from your own sign-in, never from anything typed into a form or link. A different dealership's number in a web address doesn't give access to anything.
• Access is checked on every click. Each time you open a page, MotoDealerHQ re-checks that your membership is active and that the dealership allows sign-in. Removing or suspending someone takes effect on their very next click.
• Every record is scoped. All database reads and writes are limited to the current dealership, and the database itself refuses links between records of different dealerships. A record that belongs to someone else shows "not found", so its existence isn't even confirmed.
• Files are stored per dealership. Photos and attachments sit in a separate folder for each dealership. Private files (such as customer attachments) are only served after a permission check, and uploaded images are re-encoded, which strips hidden location data.
• Background work stays in its lane. Imports, emails and other background jobs carry their dealership with them and can't drift into another account. Caches are separated the same way.
• Your website and your console are separate. Your public website (on your motodealerhq.com address or your own domain) never receives console sign-in cookies. Staff always sign in at dealer.motodealerhq.com.
• Unknown addresses show nothing. A web address that isn't a verified domain of a dealership (or belongs to an archived one) gets a plain "not found" page with no dealership data.

MotoDealerHQ uses one shared database for all dealerships. Separation is enforced by the scoping rules above and by the database's own relationship checks. After it was built, the platform was reviewed specifically for leaks between dealerships, and none were found.

Sensitive information #

• Credit applications are the only place MotoDealerHQ collects Social Security numbers, dates of birth and income. They are encrypted with their own key, masked for staff by default, and never appear in logs, emails, exports or the AI assistant. See Credit applications and lenders.
• Website forms you build can't ask for Social Security, credit-application or bank account details. Those fields are refused.
• Integration passwords and keys are encrypted and never shown again after you save them; the console shows only "set" or "not set".
• Form submissions store a scrambled version of the visitor's IP address, not the address itself.

Limit what your own staff can see #

Inside your dealership, each person sees only what their role and location access allow.

1. Open Settings › Users and select Edit next to a team member.
2. Check their Role. Roles are deny-by-default: anything not granted is off. See Users, roles and two-factor sign-in.
3. Under Locations, untick Access to all locations and tick only the rooftops they work at.
4. Select Save.

(open full size)

1. Access to all locations. When ticked, the person works across every rooftop.
2. Individual locations. Untick "all" and tick specific rooftops to limit their inventory, leads and appointments to those locations.

Other built-in limits:

• Salespeople see only the leads assigned to them (leads.view_own), not everyone's.
• Costs and profit (vehicle cost, gross, part costs) need their own permissions, and the Read Only role never gets them.
• Full credit-application details need finance.view_sensitive plus re-entering your password, and every reveal is recorded.

Tips #

• Review Settings › Users every quarter. Suspend people who have left, and check that nobody has a broader role than they need.
• Use the audit log to see who changed users, roles or settings.
• Give MotoDealerHQ support read-only access unless they need to change something. See Support access.

Permissions #

Limitations #