How LotDesk protects your customers’ information

Own login for each person. Passwords are stored only as a one-way scrambled hash (scrypt), never in readable form. After 5 wrong passwords in a row, a login locks for 15 minutes. Sign-ins end after 7 days, and right away when a login is turned off.

Two-step sign-in. A 6-digit code from an authenticator app on the person’s phone, with one-time backup codes. The owner can require it for everyone.

Roles. Owner, Manager, Sales, and Collector each see and change only what the job needs. Only owners manage users, settings, and backups.

Encryption. Every connection uses HTTPS. Driver licenses, insurance cards, titles, and contracts are encrypted (AES-256-GCM) before they are stored, and so are two-step secrets. The database host encrypts all stored data.

Activity log. Sign-ins, locked logins, payments taken and voided, loan changes, backups, and changes to users are recorded with who and when (Settings, Activity log).

Text messages. Sent only to customers who agreed to texts. A reply of STOP turns texts off for that customer automatically.

Your data is yours. The owner can download everything at any time (Settings, Import and export). Backups leave out passwords and two-step secrets.

Hosting. The app runs on Vercel and the database on Neon (PostgreSQL).

Name one person in charge. Your Qualified Individual oversees the program and reports to the owner at least once a year.

One login per person. Never share a login. Turn on two-step sign-in for everyone.

Remove access the same day. When someone leaves, turn off their login in Settings, Users.

Lock your devices. Computers and phones used for LotDesk have a passcode, lock when idle, and get updates.

Paper. Keep files with customer information locked away, and shred them when you no longer need them.

Check the activity log. Look it over once a month for anything you do not recognize.

If something goes wrong. Call LotDesk right away. If unencrypted information about 500 or more customers is involved, the dealership must notify the FTC within 30 days.