Written for the person who has to sign off on this. Every control below is implemented and running in the product today: not planned, not inherited from a hosting provider. This page changes the same day the app does, not on a review cycle.
From how a person signs in, to how a record is stored, to which outside services ever see dealership data at all.
Online, and against your dealership's own data
Every password is scrambled beyond recovery before it's ever stored.
Signed and tamper-proof, expiring on their own after 12 hours and after 30 minutes idle. Signing out revokes the session on the server, so a closed app can't be reopened back into.
An authenticator-app code on top of a password, available to every account. An admin can make it mandatory for any role, and that requirement is enforced at sign-in on the server - a staff member cannot skip past it from the browser.
Repeated wrong passwords lock the account and alert an admin.
Ten job roles, each seeing only what that role needs to.
Anything that changes data has to be started from inside the app itself. A request arriving from another website a staff member happens to have open is refused.
Every connection is encrypted, with Cloudflare standing in front.
Encrypted at rest at the application level (SQLCipher), and every query is built to prevent injection attacks.
Anything a person types is sanitized before it's ever displayed back.
Stored privately, shared only through links that expire in five minutes.
Checked for size and type, renamed on arrival so a filename can't be weaponized.
Text pulled out of screen captures and uploaded documents is erased after 90 days, and the record itself is deleted at two years. The FTC Safeguards Rule allows two years; the content is gone long before that, because nothing in the app reads it after the day it was created.
Runs on Google's Gemini Enterprise platform (formerly Vertex AI), under a signed data-processing agreement.
Only a VIN is sent, to a public government database.
Only a VIN and mileage, for trade-in pricing.
Vehicle make, model and year - never the VIN itself - sent to look up OEM part numbers.
The captured image is never stored anywhere - it is read once and discarded. The text that comes back is scanned for card numbers, Social Security numbers and bank details, which are stripped before it is written down.
Customer records aren't needed just to match a spreadsheet column.
Imported spreadsheet text, documents and stored notes are fenced off before the AI sees them, so wording inside a record can't be used to give the AI instructions of its own.
Runs on Railway, deployed automatically from source control.
The database lives on a persistent, private volume.
Every login, logout, admin action, data export and customer-photo view is recorded with who and when - each entry cryptographically chained to the one before it, so a removed or altered record is detectable rather than silent.
API keys and the database encryption key live in the deployment environment, never in code, and never in the source history - which is checked on every change. Rotating the encryption key is a written, scripted, verified procedure rather than an improvisation.
Built with the FTC Safeguards Rule in mind, not added after the fact.
The database is copied off the server every hour to separate encrypted storage, and every copy is verified before it is kept - worst case, one hour of data at risk, and under an hour to restore. Photos and uploaded documents are backed up the same way.
Google Cloud, Cloudflare, Resend, and Railway are the only outside organizations under a data-processing relationship with this app, and each one carries its own independently audited security certifications - no analytics, advertising, or data-broker integration exists anywhere. Three narrower lookups sit outside that relationship entirely: a bare VIN to NHTSA's public recall database, a VIN plus mileage to Auto.dev for trade-in pricing, and a vehicle's make, model and year - never the VIN itself - to a parts catalog for OEM part-number lookups. None of the three is a data processor in the same sense - none ever receives a customer's name, contact information, or anything else that identifies a person, only information about the vehicle itself.
Certifications shown are each provider's own current public claims, verified against their own documentation. Full detail: Google Cloud ↗, Cloudflare ↗, Railway ↗, Resend ↗
Zero Data Retention statusApproved by Google
Google Cloud's standard terms retain AI request/response content for up to 55 days for abuse monitoring. Google has approved our Zero Data Retention exception request for this account, removing that window entirely - Gemini request/response content is no longer logged or retained for abuse monitoring, and is not subject to human review as part of that process.
Security that depends on someone remembering to look is security that decays. Every change to this app is scanned before it ships - not quarterly, not on request, but on every push, by tools that fail loudly rather than warn quietly.
Every outside library the app depends on is checked against the public vulnerability database on each change, and a robot opens a fix request when one is found. Current status: none known.
Two independent scanners read the source for the patterns behind real-world breaches - injection, unsafe handling of untrusted text, credentials in the wrong place. Both currently clean.
The entire history of the codebase - every change ever made, not just the version running today - is scanned for accidentally committed passwords and API keys. A single credential anywhere in that history fails the build. Nothing has ever been found.
An automated test suite runs on every change, and every security fix ships with a test written specifically to fail if that fix is ever undone. A change that quietly reopens a closed hole does not get to ship.
Database encryption is designed to keep working if a component is missing rather than crash - which would make a broken setup invisible. So each build asserts out loud that encryption is genuinely active.
Backups are verified when written and the restore procedure is written down and tested, because a backup nobody has restored is a backup nobody knows works.
Answered here rather than after three rounds of email. If your review needs something not covered below, ask - the answer exists, and it is written down.
Service-lane operating data: vehicles, repair order summaries imported from your DMS's own spreadsheet export - RO number, dates, totals, the work performed - never the full repair order document itself, appointments, parts, and the notes staff write about them. Dealer Synapse never asks for, processes, or stores a payment card number, and it is not part of your F&I or credit-application flow. The narrower the data, the smaller the question.
Named accounts only - no shared logins - across ten job roles, each limited to what that role needs. Deactivating an account or signing it out revokes the session on the server immediately, so access ends when you say it ends, not when a cookie happens to expire.
Every login, logout, admin action, data export and customer-photo view is recorded with who and when, and each entry is cryptographically chained to the one before it. A deleted or altered audit entry is detectable rather than silent - which is the property that makes an audit trail worth having.
It runs on Google Cloud's enterprise Gemini platform under a signed data-processing agreement, with a Zero Data Retention exception Google has approved for this account. Dealership data is never used to train a model. Imported records are fenced off before the model reads them, so text inside a spreadsheet cell cannot issue instructions of its own.
Every layer that could expose dealership data already is. The database runs on Railway (SOC 2 Type II, SOC 3); every outside service a feature actually sends data to - Google Cloud, Cloudflare, Resend - carries its own SOC 2 audit, named above rather than taken on faith. The two narrower lookups outside that circle (a VIN to NHTSA, a VIN and mileage to Auto.dev) never carry a customer's name or contact details. An independent audit of the Dealer Synapse application itself is on the roadmap as the pilot scales - until then, we complete your security questionnaire in full and in writing, and every control on this page can be demonstrated live.
Hourly encrypted backups to storage separate from the server, each one verified as it is written. The restore has been exercised end to end against the real schema - 57 tables, zero mismatches - and the procedure is documented step by step rather than living in one person's head.
Every request re-checks who's asking and what they're allowed to see - on the server, every time, regardless of what the screen in front of them shows.
Every outside service that touches dealership data is listed above, with exactly what it receives - a VIN, a mileage figure, nothing more than the feature needs.
Where a control has an edge - what a screen capture can pick up, which certifications belong to a provider rather than to us - this page says so directly. A vendor who tells you the boundary is a vendor you can check.
Happy to walk your team or JLR's own compliance review through exactly how this works.
Get in touch