Trust Center
Dealership data protected through clear ownership, controlled access, and documented operating practices.
Every control below is published with its current state, taken from an internal verification record.
Last reviewed . Reviewed quarterly. Live service health is on the status page; processing terms are in the DPA.
- Dealership retains ownership
- Role-based access
- Tenant separation
- Encryption in transit and at rest where verified
- Export and deletion processes
- Documented incident handling
Data ownership
The dealership owns the record. RooftopOS holds it.
The appraisals, consents, disclosures, media and customer history created in RooftopOS belong to the store that created them: the dealership is the controller, RooftopOS the processor, and that allocation is written into the Data Processing Agreement rather than asserted here.
The platform holds what the workflow requires and stops there — staff accounts, roles and store configuration, and the contact details, uploads, vehicle and consent records a consumer submits, each stored against the version of the language they were shown. No Social Security numbers, no credit checks.
Access control
Roles enforced by the database, not by the interface.
Roles are enforced at the data layer rather than by hiding a button, so an action taken under a role is attributable to an account and a timestamp.
Tenant isolation
Separation enforced at the data layer.
RooftopOS is multi-tenant on shared infrastructure. Tables holding customer data carry row-level policies rather than trusting the application to ask nicely, and those policies are reviewable under NDA.
Encryption and infrastructure
Inherited where it is inherited, and said so.
Every connection is served over HTTPS and data at rest is encrypted by the storage platform, under terms that provider publishes and the register below links — properties RooftopOS inherits rather than ones it operates. Origin and storage are in United States regions; the delivery network is global, so calling the whole system US-only would be false.
Data retention and export
Deletion and export are processes, not buttons.
Deletion requests are honoured, and a store that leaves takes its records with it. A request goes through the security or support channel and is carried out by the RooftopOS team, on the timeframes set out in the DPA.
Two things get read as one here. The applications write versioned, timestamped disclosure and consent records against the VIN — product data, dated in the changelog. The control over it is what the matrix below records as Planned: there is no audit log a dealership reads, queries or exports for itself. RooftopOS produces a packet on request.
Incident response
Seventy-two hours, in writing.
RooftopOS notifies the customer in writing within 72 hours of a confirmed personal-data breach, with the known scope and what the store should do next. That commitment is in the Data Processing Agreement, so it is signed rather than published.
Send vulnerability reports to the security channel; they are acknowledged in writing. Please do not exfiltrate data, pivot into other systems, or publish before it is fixed. There is no bug-bounty programme.
Not claimed: any right to resell dealership or consumer data, market to your customers, syndicate your opportunities, or train a model on your records for someone else’s benefit. The agreement permits none of it. What is not in place — single sign-on, just-in-time elevation, hardware-key multi-factor authentication, customer-visible audit-log export, a published retention schedule, a deletion-turnaround commitment, self-service export, a specific cipher or minimum TLS version, a tested restore, a documented runbook, an on-call rotation, complete tenant isolation and independent verification of it — is in the matrix below, each with its actual state.
Vendor management
Every vendor in the path.
Produced by auditing what the software calls, with 30 days’ written notice before a vendor is added and each vendor’s own documentation linked. The same register drives the DPA.
| Sub-processor | Purpose | Data categories | Region | Retention | Documentation |
|---|---|---|---|---|---|
| Cloudflare | Hosting, content delivery, TLS termination, DoS protection | IP address · User agent · Request metadata · Anything in transit | Global edge; origin and storage in the United States | Not published; available under NDA | |
| Supabase (Postgres) | Primary database and authentication | Lead and demo submissions · Newsletter subscribers · Review submissions · Operator accounts | United States | Managed backups on the provider's schedule; window not published | |
| SentryOnly when configured | Error monitoring, performance tracing, session replay | Error messages and stack traces · Request URL and browser context · Session replay of the error page, with text and inputs masked | Not published; available under NDA | Not published; available under NDA | |
| ResendOnly when configured | Transactional and confirmation email | Email address · Name · Dealership name · Message body | United States | Not published; available under NDA | |
| SlackOnly when configured | Internal notification of a lead, signup or review | Name · Email address · Phone number · Dealership name · Message body · Submission source | Not published; available under NDA | Held in the receiving workspace under its own retention policy |
|
| Cal.com | Demo and briefing scheduling | Name · Email address · Time zone · Booking-form entries | Not published; available under NDA | Held in the RooftopOS scheduling account until deleted |
|
- Sentry: Session replay is captured when a client-side error occurs. Text, inputs and media are masked in the browser first, so a replay shows layout and clicks, not what was typed. Page addresses are recorded, and an unsubscribe link carries the recipient's email address in that address.
- Cal.com: Booking a demo leaves this site and enters details with the scheduling provider.
Named elsewhere, not in this path. Cloudflare R2, Twilio, OpenAI appear on legal pages covering the wider platform but are not in this site’s path. A review scoped to the product should ask for them.
No vendor at all in these categories.
- Analytics and visitor tracking: No analytics vendor, tag manager, advertising pixel or tracking script is loaded.
- Web fonts and font CDNs: Served from this origin, so loading a page discloses no IP address to a font provider.
- Payments: No payment processor is integrated and no card details are collected.
- Video, audio and transcription: No video hosting, recording or transcription provider is in this site's path. AutoFilm's video runs in the product application, outside this register.
- VIN, valuation and vehicle data: No VIN decode, valuation or vehicle-history provider is called from this site. The applications' VIN and recall lookups run in the product application, outside this register.
Control status
Every control, and its current state.
Four states, no synonyms. Verified requires evidence. Reviewed .
- Verified5
- Implemented5
- Partially Implemented4
- Planned6
| Control | State | Basis |
|---|---|---|
| Data handling | ||
| Data residency — United States | Implemented | Configured at the storage provider. The delivery network is global; origin and storage are US. |
| Marketing contacts deletable independently | Verified | A separate store with its own delete policy. Unsubscribing touches no deal record. |
| Retention schedule, deletion turnaround and self-service export | Planned | Deletion is honoured on request. No schedule, turnaround or self-service export is published. |
| Authentication and access | ||
| Role-based access enforced at the data layer | Implemented | Evaluated by the database on every query, separating authenticated from administrative operations. |
| Multi-factor authentication on administrative accounts | Partially Implemented | Required on administrative access. No attestation of enforcement exists, so none is claimed. |
| Documented rotation cadence for service credentials | Planned | No rotation cadence is documented. |
| Single sign-on (SAML) and just-in-time elevation | Planned | Not built. Roadmap work for dealer-group onboarding. |
| Tenant isolation | ||
| Tenant isolation — separation enforced at the data layer | Partially Implemented | Row-level policies scope a row to the account permitted to read it, evaluated on every client query. No third-party attestation covers tenant separation, so this reads as partial. |
| Encryption | ||
| Encryption in transit | Verified | Served only over HTTPS; the platform does not serve plaintext. The protocol floor is a provider setting. |
| Encryption at rest | Verified | A property of the managed database platform, published in that provider's documentation. |
| Security response headers | Partially Implemented | Set on every response and read back off a rendered document. The content policy is not yet at full intended scope, so this reads as partial. |
| Backups and tested restore | Partially Implemented | Taken by the storage platform. No restore test is recorded, so recoverability is not asserted. |
| Logging and monitoring | ||
| Application error monitoring | Implemented | Captured where the monitoring service is configured. Ingestion is not alerting, so this is not continuous monitoring. |
| Live service health check | Verified | The public status page makes a real request against the backend on every load. |
| Customer-facing audit logging and export | Planned | No log a dealership can read, query or export for itself. The versioned per-VIN records the applications write are product data, not this control. |
| Incident response | ||
| Written breach notification within 72 hours | Implemented | A commitment in the DPA rather than a control a reviewer can test. |
| Written vulnerability intake | Implemented | A monitored security mailbox, acknowledged in writing. |
| Documented runbook, on-call rotation and tabletop exercises | Planned | None exists today, and none is described as though it did. |
| Vendor management | ||
| Sub-processor register, published and kept current | Verified | Built by auditing what the software calls, and it drives the DPA, so the two cannot drift. |
| Third-party attestation — SOC 2, ISO 27001, independent penetration test | Planned | None held today, and no date is published because none is committed. |
A state is data, not copy: a row moves by closing the gap, never by editing this page. Planned rows carry no date, because none is committed.
RooftopOS does not currently claim SOC 2 or ISO 27001 certification. No target date is published, because none has been committed to.
Security review
Start your security review.
Write to Report a security issue with questionnaires or anything here you want substantiated. Send whichever standard your team uses — CAIQ-Lite and SIG-Lite are both fine — and it comes back completed.
Architecture detail, control descriptions and the underlying evidence are available to qualified parties under a mutual non-disclosure agreement.