Security
How CarShots protects dealer and buyer data
When you put buyer information into CarShots Compliance, we become your service provider under the FTC Safeguards Rule. So we hold ourselves to the same rule we help you meet. This page says what we do, in plain words, and what we will tell you if something goes wrong.
Updated October 31, 2026
How we protect your customers' information
MFA is required on compliance accounts
Every CarShots Compliance account signs in with a second step: an authenticator app or an emailed code, with backup codes for a lost phone. It is offered on every other CarShots account too.
Sensitive fields are encrypted
Buyer names, birth dates, addresses and free-text notes are encrypted field by field with AES-256-GCM before they are saved, on top of the database's own encryption at rest. The key lives outside the database.
We collect less
We never ask for Social Security numbers. When the phone camera reads a driver's license, we keep the result, not the photo. Uploaded deal files are deleted after 30 days unless you choose to keep them.
Private file storage
Deal files and vendor proofs are stored privately under keys no one can guess. They open only through a link that checks who you are first, never a public address.
An audit log you can see
Every view of buyer details, every export, print, signature, invite, cleared match and deletion is logged with who did it and when. Owners see the log in their settings.
Access on a need-to-know basis
Inside your store, the owner decides who sees what. Inside CarShots, staff reach a dealer's records only to support that dealer, and those views are logged too.
If something goes wrong, we tell you
If we learn that customer information you put in CarShots was acquired without authorization, we will email the account owner promptly, without waiting until every detail is known.
We will tell you what happened, which records were involved, what we have done about it and who to contact. That is the information you need to decide whether your store must notify the FTC, which the Safeguards Rule requires within 30 days of discovery when 500 or more consumers are involved.
We will keep updating you as we learn more, and we will help you answer the FTC form.
What we don't promise
- No system is perfectly secure, and we do not claim ours is. We build to reduce the chance and the damage of a breach, and to tell you fast if one happens.
- Your own logins, devices and staff are part of the picture. Keep MFA on, give access only to people who need it, and remove staff when they leave.
- Templates and tools, not legal advice.
Security questions or a report about a weakness? [email protected]
Questions dealers ask about our security
Is CarShots my service provider under the Safeguards Rule?
Yes, for the customer information you put in CarShots Compliance. The rule asks you to pick service providers that can protect it, require that in your contract, and check on them from time to time. The addendum on this site is written for that.
Do you store Social Security numbers or license photos?
No. We don't ask for Social Security numbers, and when the camera reads a license we keep only the result of the check.
How long do you keep deal files?
Uploaded deal files are deleted 30 days after upload unless you mark one to keep. The check results stay with your records.
Can I see who looked at a buyer record?
Yes. The audit log in your settings shows every view, export, print and change, with who did it and when.
Will you fill in our vendor security questionnaire?
Yes. Email [email protected] and we will answer reasonable questions about our program, as the Safeguards Rule expects you to ask.
Sources
Last verified October 31, 2026.
Keep reading
- Service provider security addendumCarShots' security commitments to dealers as their service provider under the FTC Safeguards Rule, 16 CFR 314.4(f). Printable.
- Dealer compliance software with a published priceAnswer ten minutes of questions and AI writes your Safeguards, Red Flags and privacy paperwork, then runs OFAC, Form 8300 and staff lessons. From $99 a store.
- The Safeguards Rule Qualified Individual: who can hold the roleWho can be the Qualified Individual under the FTC Safeguards Rule, what the role does, and the three conditions when an IT company holds it.
- FTC breach notification for dealers: who, when and what to reportWhen a dealer must tell the FTC about a data breach: 500 or more consumers, 30 days from discovery, the six answers on the form and the first steps.
- Privacy PolicyHow CarShots collects, uses, shares and protects your information, how long we keep it, and how to exercise your privacy rights.
See your compliance gaps and a free draft plan
Answer about ten minutes of questions. Get your score, your gap list and a watermarked draft of your security plan, free with no card. Essentials is $99 per store a month when you're ready.