Under GLBA, most dealerships that finance or lease vehicles are treated as financial institutions. The FTC's Safeguards Rule applies to you directly — the same rule that covers non-bank lenders.
FTC · Auto dealer Safeguards FAQs, June 2025Defensive Infrastructure That Survives Attacks And Audits
The FTC Doesn't Grade Your Intentions. It Looks At Your Infrastructure.
From vendor ransomware to GLBA Safeguards mandates, we architect hardened, isolated systems that protect customer data, preserve transaction records, and keep your doors open.
Book an Infrastructure AssessmentNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-RooftopNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-RooftopNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-Rooftop
Regulatory status
The Government Already Regulates You Like A Bank.
Not as a suggestion. As a classification.
The amended Safeguards Rule has been in force since June 2023. This is not upcoming. This is not proposed. It is operating law.
FTC · amended Safeguards Rule deadline, June 9, 2023If unencrypted customer information involving at least 500 consumers is acquired without authorization, you must notify the FTC as soon as possible — and no later than 30 days after discovery. In effect since May 2024.
FTC · Safeguards notification requirement, May 2024You are required to designate a qualified individual accountable for your information security program. Not “the IT guy’s cousin.” A named, accountable role.
16 CFR Part 314 · Safeguards RuleMost rooftops don't learn about any of this until the examination. The resilient ones learned years ago.
Patchwork vs institutional
Banks Run Bank-Grade Infrastructure. Most Dealerships Run A Patchwork.
If you are regulated like a bank, your infrastructure should be built like one.
Most rooftops are not. Most are running a consumer-grade patchwork — the same stack you could run a donut shop on. A website platform. Some plugins. A form builder. A shared inbox. A couple of tools bolted on over the years.
That stack was never built for security. It was built to put a business on the internet. Fine for selling donuts. Not fine for a business holding financing applications, F&I files, and the personal data of every customer who has ever walked the lot.
Here is what that patchwork looks like in practice
- 01A website platform built 10-20 years ago, held together by plugins — including plugins their own developers abandoned years ago
- 02Every plugin is a door. Every abandoned plugin is a door left unlocked — permanently.
- 03Lead data flowing through form builders and third-party widgets nobody has ever vetted
- 04One shared admin password, passed between salespeople by text
- 05A CRM bolted onto a DMS, bolted onto a website, bolted onto an ad account — glued on one at a time, none of it designed to work together
- 06Backups that were configured once and never tested once
None of this was reckless when it was built. The internet was different twenty years ago. The dealership was not treated like a financial institution.
It is now.
What institutional-grade looks like
- 01Code you own, not plugins you rent — nothing abandoned, nothing left unlocked
- 02Surfaces isolated: what the public touches never touches what the operation runs on
- 03Access governed per person, logged, auditable
- 04Recovery tested, not assumed
Here is what most vendors will not tell you: none of this requires rebuilding your website.
We can isolate, harden, monitor, and back up the stack you already run — starting this week. Your current site keeps selling while we secure everything behind it.
And when a rooftop is ready for the end state, we build forward on modern architecture (Next.js) — code, not plugins. No plugin doors. No abandoned parts. Infrastructure designed the way banks design theirs: owned, isolated, auditable.
Start with what works. Evolve to what survives. That is the difference between patchwork and infrastructure.
The CDK Lesson
Architectural Resilience. Not Antivirus Theater.
In June 2024, a ransomware attack on CDK Global knocked out systems used by more than 15,000 dealer locations for roughly two weeks. Not because those rooftops lacked firewalls. Because operational infrastructure had no redundancy, no isolation, no backup path. One vendor. One breach. Thousands of rooftops back on paper. An estimated $944M+ in dealer losses in the first three weeks — and CDK reportedly paid a $25M ransom.
Source · CRN · June 2024 · Anderson Economic Group · June 2024 estimate · CNN · July 2024 · ransom reported, not confirmed by CDKWhat keeps a rooftop working through an outage like that: offline backups, independent communication, and diversified vendors. That is what we build.
Six security controls
Isolation First. Then Continuity.
Six controls. One sequence. Public surfaces get isolated before we talk about growth.
Close the doors
Attack Surface Reduction
Eliminate unmonitored plugins, exposed endpoints, and legacy entry points before anything else is added.
- Plugin inventory
- Endpoint map
- Legacy retirement
Hold the perimeter
Hardened Edge Protection
Enterprise network security, bot defense, and perimeter isolation around the customer-facing stack.
- Edge policy
- Bot defense
- Perimeter isolation
Split the house
Isolated Infrastructure
Separate public web assets from inventory, CRM, and DMS networks so a public hit does not take the rooftop dark.
- Public vs core
- DMS isolation
- CRM segmentation
Govern PII
Controlled Data Flow
Secure PII pipelines that stop unauthorized third-party leaks across intake, F&I, and service.
- Intake lock
- F&I path
- Third-party gates
Stay awake
Continuous Oversight
Detection, anomaly alerts, and active monitoring — not a quarterly PDF.
- Detection
- Anomaly alerts
- Active watch
Keep the doors open
Business Continuity
Redundant systems and backup procedures designed to keep core operations running when a vendor fails.
- Redundancy
- Backups
- Failover drills
What we harden
The Surfaces That Actually Hold Customer Data.
- 01Website & public customer intake forms
- 02DMS access pipelines & API integrations
- 03CRM & lead management systems
- 04Payment processing & loan documentation storage
- 05Employee access privileges & administrative credentials
- 06Email & communication channels
- 07Backup, recovery, & failover infrastructure
The gap
The Hidden Exposure.
Your IT company protects your network. Your antivirus protects your endpoints. But who protects this?
- 01Customer intake forms sitting on consumer WordPress
- 02Lead data flowing through 7 unmanaged third-party tools
- 03Financing records in a shared spreadsheet
- 04Employee credentials logged nowhere
- 05DMS access with no audit trail
- 06Backup system with no documented recovery path
That's not security. That's hoping nothing happens. The FTC sees that. So does every attacker.
Penalty math
The Penalty Math Is Not A Rounding Error.
Safeguards: the escalation is on the record
2023
The amended Safeguards Rule takes effect (June).
2024
FTC breach notification takes effect for qualifying incidents (May).
2025
The FTC publishes Safeguards FAQs written for auto dealers (June).
On a separate track — pricing, not cybersecurity — the FTC sent warning letters to 97 dealer groups over deceptive pricing in March 2026.
Source · FTC · March 2026 · deceptive-pricing warning lettersThe math
- Where the FTC can seek civil penalties — such as violations of FTC orders or knowing violations of certain FTC rules — the current maximum is $53,088 per violation.Source · FTC · 2025 civil penalty adjustments
- How violations are counted depends on the law and the facts. At retail volume, a gap repeated across many deals can multiply exposure quickly.
- FTC orders can name the individuals responsible, not only the company.
One unaddressed gap, repeated at retail volume, adds up fast.
Technical sequence
01Isolate
02Harden
03Monitor
04Recover
Build-out
Six Weeks To A Live Foundation.
Week 1
Assessment and threat-surface gap analysis
Weeks 2–3
Isolation and core hardening
Week 4
Monitoring and audit logging
Weeks 5–6
Failover tests, documentation, go-live
The transformation
The 6-Week Transformation.
Before infrastructure
- Fragmented tooling. High compliance risk. Operational fragility.
- One vendor down = rooftop dark.
- One audit = exposure revealed.
- No incident response plan. No recovery path.
After infrastructure — 6 weeks
- Isolated, hardened systems. Audit-ready technical controls.
- One vendor down = a documented backup path for core operations.
- Compliance audit = technical evidence already on file.
- Incident response plan rehearsed. Recovery path tested.
Most dealerships wait for the problem to build the solution. The resilient ones build the solution before the problem arrives.
Scope & partners
Where Our Work Ends. On Purpose.
We architect and operate the technical layer: encryption, logging, access control, monitoring, incident response, and recovery.
The legal, regulatory, and training layers belong to specialists. When you need them, we connect you with the strongest partner available for your jurisdiction — not a bundled add-on, not a checkbox vendor. We don't sell a compliance program, and we won't pretend otherwise.
That honesty is why rooftops trust us more than vendors who overclaim.
Protect Your Dealership Operations.
Book an Infrastructure Assessment. We map exposure, isolate the public surface, and stand up a recovery path before the next vendor event.