FTC Safeguards Rule program
Your written information security program, risk assessment, Qualified Individual support, vendor oversight, incident response plan, and the annual board report. Built, maintained, and documented.
Compliance infrastructure for auto dealers
Dealership compliance is a checklist. DealSafe runs it.
You did not ignore the FTC Safeguards Rule. Nobody translated it into dealership terms. DealSafe does. One program covers your Safeguards obligations, Red Flags identity verification, and staff training. Priced per rooftop. Published on this site.
Already decided? Start your order.
Four parts
The DealSafe program
What DealSafe runs
One program. Four parts. Every rooftop.
Red Flags & ID verification
Identity verification on the deal, while the customer is in the F&I office. Not an audit that finds the problem after funding. Your written Identity Theft Prevention Program stays current because the system updates it.
Training & audit support
Training that survives sales-staff turnover above 60 percent. Every completion logged. When an examiner, lender, or buyer asks for proof, you produce your Book of Evidence in 48 hours.
Customer-entered. QR-simple. Locked down.
The buyer scans a code and completes verification, the application, and every consent on their own phone. Your salespeople see deal status, never the PII. Sensitive data stays with the GM and the F&I office, the way the Safeguards Rule expects.
Step 1 — Gap assessment
Tell us about your store. Within 24 hours we schedule a working session and map your current program against the rule, line by line. Free. No obligation.
Step 2 — Video-led onboarding
Your team sets up through short guided videos, not a binder of PDFs. No learning curve on your dime.
Step 3 — Run the program
DealSafe tracks the tasks, logs the training, verifies the identities, and keeps the evidence current. You sell cars.
Your CRM is one system. The Safeguards Rule covers your whole store.
Does the Safeguards Rule really apply to my dealership?
Yes, if you finance or arrange financing or leasing. The FTC's own dealer FAQ says most automobile dealers who finance or lease automobiles are financial institutions under the rule. That has been fully mandatory since June 9, 2023.
We already have a compliance binder. Is that enough?
A binder is a snapshot. The rule requires a living program: current risk assessment, monitored controls, logged training, vendor contracts, and an annual report to ownership. If the incident response plan in your binder has not been opened since 2019, you have a paper program, not a current one.
Is DealSafe another dashboard my team will ignore?
No. DealSafe is the program of record, not a fifteenth login. It assigns the tasks, runs the training, verifies identities at the desk, and stores the evidence. Your team's job is to follow the checklist. Ours is to keep it current.
Our CRM is secure. Doesn't that make us compliant?
No. A CRM is one system, and the Safeguards Rule covers your whole store. Most stores need a Qualified Individual, a written risk assessment and security program, trained staff with records, oversight of every vendor that touches customer data (your CRM included), an incident response plan, and an annual report to ownership. DealSafe runs that program around the systems you already use. Keep your CRM.
What does it cost?
Per-rooftop monthly tiers, published on our pricing page. No setup fee. A 12-month agreement, billed monthly. See pricing.
The threat did not disappear. It changed uniforms.
The FTC's CARS Rule is dead. Enforcement is not: a $20 million judgment, a $3.1 million penalty with refunds on more than $75 million in charges, and 97 dealer groups on written notice, all since December 2024. A documented program is the difference between a headache and a headline.
Independent lot or franchise group. Same discipline.
Independent and BHPH dealers
You are the creditor. Red Flags covered accounts, identity verification at the desk, and a program that does not need a compliance department to run. Priced per rooftop so a single store can afford to do this right.
Franchise groups
One standard across every rooftop. Group-level reporting your board can read. Documentation that holds up in buy-sell diligence and OEM reviews.
$53,088
Civil penalty, up to, per violation of FTC rules
30 days
To report a breach to the FTC, since May 13, 2024
500+
Consumers' unencrypted data breached triggers the report. The FTC posts it publicly.