Multi-tenant dealership isolation
Every record belongs to one dealership and is checked on every request; automated tests try to read across dealerships and must fail.
Trust and security
Your dealership, under your control
How we keep your data separate, who can see and do what, and the limits you set on purchasing and AI. Everything here describes what the product does today, with its known limits listed below.
Rooftop-level access
Staff can be limited to the rooftops they work at: inventory, leads, appointments, service, messages and demand reports follow the limit. Accounting (invoices, payments, refunds) is not yet limited by rooftop; see known limits below.
Employee permissions
Built-in and custom roles. Nobody can grant more access than they hold, and sensitive financial figures need their own permission.
Purchasing authorization
Purchasing limits by person, role, department and rooftop, approval chains with no self-approval, and a ledger of every commitment.
AI usage controls
AI is off until enabled for your dealership, runs within budgets you set, can only propose changes for a person to approve, and can never bid, buy or approve.
Spending limits and approvals
Dealer-set spending limits for AI and purchasing, approval workflows for anything above them, and AI budgets with hard stops by dealership, department, person and feature.
Audit logging
An audit log of who changed what and when, plus a tamper-evident audit chain on purchasing commitments that can be verified on demand.
Customer data protection
Authenticator-app two-factor sign-in with recovery codes, credit applications encrypted with a separate key and revealed only after re-authentication (and purgeable), consent-based messaging, and erasure of a customer's data on request.
Platform administrator controls
Platform staff can enter your account only when you grant support access for 1 to 72 hours, read-only or read-write, and a support session can never export or delete. Granting, receiving and using access is logged.
Dealer-controlled integrations
You connect your own Stripe, Twilio, marketplace and auction accounts, and disconnect them at any time.
Financial data restrictions
Costs, gross and finance details are shown only to roles with financial permissions.
Known limits
What we do not claim, and what is not finished.
- No third-party security certification or audit report is published. We make no certification or regulatory compliance claims.
- Accounting has no rooftop scope yet: a rooftop-limited user who holds the accounting permission can see every rooftop's invoices and payments.
- Purchasing limits cover purchases made through the platform and connected auctions. A bid placed directly on an auction's own website cannot be technically stopped.
- Erasing a customer is complete across leads, messages, appointments and requests; exporting one customer's full record is not built yet (the customer list exports basic fields).
- Third-party identity and licence checks for auction bidders are not connected; staff record manual checks.
We do not publish security implementation details here. Questions from your IT or compliance team are welcome through a support ticket.
Your dealership deserves better software.
Start a free 14–30-day trial with no card. Build your site privately, bring in your inventory, and go live when you are ready.