How familiar is your team with the FTC Safeguards Rule and the Red Flags Rule for dealerships?
We're familiar with the basics — the FTC Safeguards Rule was updated in 2023 to explicitly classify dealerships as financial institutions because they handle non-public personal information (NPI) when financing or leasing vehicles. The Red Flags Rule requires an Identity Theft Prevention Program for creditors, which dealerships are. We're not your compliance advisor or NADA-affiliated regulatory consultant. What we are is the IT and security team that works alongside your dealership's compliance advisor — we own the technical safeguards (encryption, MFA, access controls, audit logging, off-site backup, endpoint protection, BEC defenses) those professionals need to be in place; they own the WISP documentation and the regulatory interpretation.
What dealer management systems (DMS) have you supported on the IT side?
CDK Global, Reynolds & Reynolds, Dealertrack, Tekion, Frazer, VinSolutions, DealerSocket, Auto/Mate, Quorum, and a handful of others. We don't replace your DMS vendor's implementation team — we work alongside them on the IT plumbing: bandwidth sizing for cloud DMS, firewall rules, MFA enrollment, single sign-on, certificate management, off-site backup integration, endpoint security on the workstations and sales-floor tablets that touch deal jackets, and the network segmentation that keeps sales, service, parts, F&I, and back-office systems appropriately separated.
How do you protect customer F&I data (deal jackets, credit reports, SSNs)?
F&I systems hold some of the most concentrated personal-identity data in any retail business — Social Security numbers, driver's license images, banking details, credit reports, and full income disclosures. We harden the IT side: TLS in transit, encryption at rest, MFA on every F&I workstation, role-based access (a service writer doesn't need to see the deal jacket), audit logging on every record access, network segmentation between F&I and the rest of the dealership, secure document scanning and disposal workflows for paper records, and the documentation your compliance advisor needs to show your Safeguards Rule WISP is real.
How do you protect against wire-fraud on customer down payments and dealer-to-bank wires?
Wire fraud against dealerships is rising — fake customer wires on down payments, fake floor-plan-lender emails with updated wiring instructions, fake manufacturer rebate-deposit notifications. Our defenses are layered: business email compromise (BEC) detection on inbound mail, callback verification protocols for any wire-instruction change, dual-control approval workflows for outgoing wires, behavioral baselining on the F&I and accounting team's email, and tabletop drills so your team knows what a fraudulent wire-instruction update looks like before it's an actual loss.
What's your role if we have a confirmed or suspected breach of customer data?
We're the technical first-responders. On suspected breach: contain the scope (isolate affected systems, preserve forensic evidence, change credentials), identify what customer data was accessed and by whom, document the timeline, and provide the technical record your dealership's compliance advisor and outside breach counsel need. We don't make the FTC, state-attorney-general, or customer notification calls — that's your compliance advisor and breach counsel — but we make sure they have what they need to make those calls correctly within state-law and FTC notification windows.
Do you provide dealership-specific staff training and phishing simulations?
Yes. Generic phishing-simulation content (fake Microsoft password resets, fake DocuSign requests) catches some attacks but misses the dealer-specific ones: fake customer wire-instruction updates, fake floor-plan-lender emails, fake manufacturer rebate-deposit notifications, fake credit-report-pull authorizations. We build phishing simulations around the scenarios your dealership actually sees, document training records (so they're available for your Safeguards Rule compliance review), and report measurable improvement in your team's detection rate over time.
How do you handle multi-store dealer groups (multiple rooftops, shared back-office)?
Multi-rooftop groups have a different IT profile than single stores: identity federation across stores, shared accounting and HR systems, location-specific network segmentation, brand-specific DMS variations, central security monitoring, consistent endpoint policies, and unified phishing-simulation programs that still report by store. We build for the group level (one identity provider, one monitoring stack, one incident-response playbook) and respect the store level (each location's brand requirements, each general manager's local discretion, each location's unique tenant or franchise rules).
How are you different from an automotive-IT consultancy?
Most automotive-IT consultancies (NADA-affiliated or otherwise) deliver a written assessment and an invoice, then leave you to find an MSP to actually implement and operate the controls. We're the operator — we do the IT and security work day-to-day, alongside whatever automotive-IT consultancy or compliance advisor your dealership uses for FTC Safeguards Rule and Red Flags Rule interpretation. Plus we're locally based in Arkansas with same-day on-site response across 10 counties, not a national consultancy billing $300+/hour out of a different time zone.
