The FTC Safeguards Rule and who can log in at your dealership
Dealerships that arrange financing are generally covered by the FTC Safeguards Rule, which requires a security program that limits access to customer information to the people who need it. Removing access the day people leave, checking every month who can log in where, and keeping a record of both are practical ways to support that. StitchOps does all three across every rooftop.
Last updated
This guide is general information, not legal advice. Talk to your attorney or compliance advisor about how the rule applies to your stores.
What the rule is
The Safeguards Rule is the Federal Trade Commission's rule under the Gramm Leach Bliley Act. It is found at 16 CFR Part 314. It requires covered businesses to have a written information security program that protects customer information.
The FTC treats car dealerships that arrange financing or leases for customers as financial institutions under that law. So if your stores arrange financing, the rule generally applies to you.
Where user access comes in
The rule covers a lot of ground. One part matters every single week at a dealership: who can log in to the systems that hold customer information.
The rule calls for access controls that limit access to customer information to the authorized users who need it, and for reviewing those controls over time. At a dealership, customer information lives in places like:
- Credit and lender portals: RouteOne, Dealertrack credit and eContracting, 700Credit
- The DMS: CDK Drive, Reynolds and Reynolds, Tekion ARC, Dealertrack DMS
- The CRM: VinSolutions, Elead
A former salesperson who can still log in to any of these is exactly the kind of gap an access control program is meant to close.
Three habits that support your program
1. Remove access the day people leave
Start from HR, such as ADP Workforce Now, and remove the person from every system at every rooftop. The step by step is in how to remove a fired employee from every dealership system.
2. Check every month who can log in where
Pull each system's user list, compare it to who works for you, and fix what is wrong. See how to run a monthly access check across your dealer group.
3. Keep a record of both
Write down each removal and each check, with the date, the system and the result. If a regulator, an auditor, a lender or your insurance carrier asks how you control access, this is what you show them.
How StitchOps helps
StitchOps does not make a dealership compliant on its own, and it does not replace your security program or your advisors. It takes over the repetitive access work that is hard to keep up by hand:
- Removes access everywhere when HR marks someone as gone, at every rooftop, including portals with no way for other software to connect.
- Runs the monthly access check across the DMS, the CRM, credit and lender portals and OEM portals, compared to your HR roster.
- Keeps a record of every step, ready to hand to whoever asks.
- Keeps your passwords in your vault. The work runs on a secure computer inside your network, and the AI never sees your logins.
Canadian stores
Canadian stores have their own privacy obligations, including PIPEDA; ask your advisor how they apply to access to customer information.
More for dealer groups on the automotive page.