FTC Safeguards Rule program
Your written information security program, risk assessment, Qualified Individual support, vendor oversight, incident response plan, and the annual board report. Built, maintained, and documented.
Dealership compliance is a checklist. DealSafe runs it.
You did not ignore the FTC Safeguards Rule. Nobody translated it into dealership terms. DealSafe does. One program covers your Safeguards obligations, Red Flags identity verification, and staff training. Priced per rooftop. Published on this site.
Dealers trust other dealers. DealSafe was built by the General Manager of Wyoming's oldest and largest dealership group, and it runs in his stores first.
What DealSafe runs
One program. Four parts. Every rooftop.
Red Flags & ID verification
Identity verification on the deal, while the customer is in the F&I office. Not an audit that finds the problem after funding. Your written Identity Theft Prevention Program stays current because the system updates it.
Training & audit support
Training that survives sales-staff turnover above 60 percent. Every completion logged. When an examiner, lender, or buyer asks for proof, you produce your Book of Evidence in 48 hours.
Customer-entered. QR-simple. Locked down.
The buyer scans a code and completes verification, the application, and every consent on their own phone. Your salespeople see deal status, never the PII. Sensitive data stays with the GM and the F&I office, the way the Safeguards Rule expects.
Step 1 — Gap assessment
Tell us about your store. Within 24 hours we schedule a working session and map your current program against the rule, line by line. Free. No obligation.
Step 2 — Video-led onboarding
Your team sets up through short guided videos, not a binder of PDFs. No learning curve on your dime.
Step 3 — Run the program
DealSafe tracks the tasks, logs the training, verifies the identities, and keeps the evidence current. You sell cars.
Does the Safeguards Rule really apply to my dealership?
Yes, if you finance or arrange financing or leasing. The FTC's own dealer FAQ says most automobile dealers who finance or lease automobiles are financial institutions under the rule. That has been fully mandatory since June 9, 2023.
We already have a compliance binder. Is that enough?
A binder is a snapshot. The rule requires a living program: current risk assessment, monitored controls, logged training, vendor contracts, and an annual report to ownership. If the incident response plan in your binder has not been opened since 2019, you have a paper program, not a current one.
Is DealSafe another dashboard my team will ignore?
No. DealSafe is the program of record, not a fifteenth login. It assigns the tasks, runs the training, verifies identities at the desk, and stores the evidence. Your team's job is to follow the checklist. Ours is to keep it current.
What does it cost?
Per-rooftop monthly tiers, published on our pricing page. No setup fee. Month-to-month. See pricing.
The threat did not disappear. It changed uniforms.
The FTC's CARS Rule is dead. Enforcement is not. The FTC secured a $20 million judgment against Leader Automotive Group in December 2024. In April 2026, Lindsay Automotive agreed to refunds on more than $75 million in consumer charges plus a $3.1 million civil penalty. In March 2026, the FTC put 97 dealer groups on written notice over advertised pricing. The same conduct is now prosecuted case by case under Section 5 of the FTC Act. A documented program is the difference between a headache and a headline.
Independent lot or franchise group. Same discipline.
Independent and BHPH dealers
You are the creditor. Red Flags covered accounts, identity verification at the desk, and a program that does not need a compliance department to run. DealSafe is priced per rooftop so a single store can afford to do this right.
Franchise groups
One standard across every rooftop. Group-level reporting your board can read. Documentation that holds up in buy-sell diligence and OEM reviews.
$53,088
Civil penalty, up to, per violation of FTC rules
30 days
To report a breach to the FTC, since May 13, 2024
500+
Consumers' unencrypted data breached triggers the report. The FTC posts it publicly.