Dealership compliance software that runs the FTC Safeguards Rule for auto dealers and dealer groups

Yes, if the dealership arranges or extends financing or leasing to consumers. That makes it a financial institution under the Gramm-Leach-Bliley Act, and the FTC enforces the Safeguards Rule (16 CFR Part 314) against it. The amended requirements took full effect on June 9, 2023. A cash-only lot that never arranges financing generally falls outside it.

It keeps the store's compliance obligations in one record with owners, due dates and evidence. For the Safeguards Rule that means the written risk assessment, the testing schedule, vendor reviews, training dates and the annual report. Dealer-specific suites also cover F&I tasks such as ID verification and deal audits; Complies covers the information security program.

The rule lists nine elements in 16 CFR 314.4: a Qualified Individual, a written risk assessment, safeguards including access controls, encryption, MFA, data disposal and logging, regular testing, staff training, service provider oversight, keeping the program current, a written incident response plan, and an annual written report to the board or dealer principal.

Any single person the dealership designates to oversee and enforce the program. It can be an employee, such as the controller or IT manager, or someone at a service provider. If it is an outside provider, the dealership keeps responsibility for compliance, must name a senior employee to oversee that person, and must require the provider to maintain a compliant program.

Partly. A dealership that maintains customer information on fewer than 5,000 consumers is exempt from the written risk assessment, the continuous monitoring or annual pen test and six-month scan requirement, the written incident response plan and the annual board report. It still needs a Qualified Individual, the safeguards themselves, training and vendor oversight.

At least once every 12 months, plus a vulnerability assessment at least every six months, unless the dealership runs effective continuous monitoring that detects changes creating vulnerabilities. You also test again after material changes to your systems, such as a DMS migration. In Complies both are recurring obligations with the report attached as evidence.

Yes, when a notification event involves the information of at least 500 consumers. You must notify the FTC as soon as possible and no later than 30 days after discovery through the form on ftc.gov. A notification event is the unauthorized acquisition of unencrypted customer information. This requirement took effect on May 13, 2024.

Published dealer compliance prices run from $99 per rooftop a month for ComplyAuto's Safeguards module on The Shop marketplace to $499 to $999 per rooftop a month for DealSafe's tiers on a 12-month agreement. Complies is $47, $119 or $299 a month billed yearly per workspace, with the risk register and vendor due diligence from $119. Budget separately for scanning, pen testing and MFA from your IT provider.

No. The Fifth Circuit vacated the FTC's Combating Auto Retail Scams (CARS) Rule on January 27, 2025, on procedural grounds. That ruling does not touch the Safeguards Rule, which remains fully in force, and the FTC still polices dealer advertising and add-on pricing under its existing authority.

Yes, in one workspace. Each rooftop's systems, vendors and risks can be entered and owned separately, and the Growth plan includes up to 15 users, Scale up to 40. There is no per-rooftop fee. Complies does not produce a separate graded scorecard per store, so groups that need store-by-store league tables should look at a dealer suite.