Compliance
Last Updated: August 21, 2026
This page answers the questions a dealer group's compliance officer asks before a vendor is approved. It is written to be usable in that review: specific positions, named gaps, and no certification claims we cannot evidence. Where the answer is "we do not have that", the page says so in the same font as everything else.
Self-attested — every seal links to its own proof
Certifications, attestations, standards, and regulations
Eight claims you can check in eight clicks
Nobody issued these. Each one is a statement about how this software is built, and each one is a link to the section of this site that describes the mechanism behind it — so a claim that stops being true has somewhere visible to fail.
Regulations we operate under
Standards and practices, self-attested
Certifications and attestations
The infrastructure is audited. The audits are theirs.
The five companies that hold the substance of your data — the database, the payments, the hosting, the model that reads your figures, and the error tracker — hold the certifications we do not. Those certificates belong to them, cover their platforms, and say nothing about our application. We name them because a vendor questionnaire asks and the answer should be findable, not to stand closer to them than the facts allow.
Stripe
PCI DSS Service Provider Level 1 · SOC 1 and SOC 2 Type II on request · a public SOC 3
Their audit, linked — verify it at the source.
Netlify
SOC 2 Type 2 · ISO 27001 · ISO 27018 · PCI DSS v4.0 · HIPAA
Their audit, linked — verify it at the source.
Anthropic
SOC 2 Type I and Type II · ISO 27001:2022 · ISO/IEC 42001:2023 for AI management · HIPAA-ready with a BAA
Their audit, linked — verify it at the source.
Sentry
SOC 2 Type I and Type II · ISO 27001 · HIPAA attestation
Their audit, linked — verify it at the source.
Read off each vendor’s own public compliance page on 21 August 2026; theirs is the authoritative version and it can change without us noticing. These five are not the whole list — every outside company that receives data is named in the sub-processor table on the compliance page, including the ones with no public certification list to quote.
1. GLBA and the FTC Safeguards Rule
A dealership that arranges or facilitates vehicle financing is a financial institution under the Gramm-Leach-Bliley Act, and the deal records that flow through The DAS Board are that dealership's customer information. That makes us a service provider under the Safeguards Rule, and Section 12 of our Terms of Service now carries the commitment contractually rather than leaving it implied:
- Safeguards appropriate to the customer information we receive, described mechanism-by-mechanism on our Security page
- Use limited to providing the service to you — never our own marketing, never sold, never shared for cross-context behavioural advertising
- Notification without undue delay after we become aware of a security event affecting your customer information, with what you need for your own notification obligations
- Materially equivalent obligations imposed on any sub-processor that handles it
- The information you need for your own Safeguards oversight of us, on reasonable request
Data minimisation as the primary safeguard
The strongest thing we do for Safeguards compliance is not a control, it is an absence. The product has no field for any of the following, so there is nothing to safeguard, breach, or subpoena:
- Social Security numbers
- Credit scores, credit reports, or credit applications
- Dates of birth
- Driver’s licence numbers
- Street addresses
- Complete telephone numbers
- Email addresses of vehicle buyers
- Financing terms — the buyer’s APR, amount financed, term, or payment
- Bank account or payment card details of any kind
Section 3 of the Privacy Policy lists what we do hold, alongside this.
2. US state privacy law
The California Consumer Privacy Act, as amended, applies to businesses meeting thresholds we do not currently meet. We extend its core rights to everyone anyway — access, deletion, correction, portability, and the right not to be discriminated against for exercising them — for two reasons. Building the rights machinery once, for everybody, is cheaper than building it the week the threshold is crossed. And a dealership evaluating us needs to know that its own consumers' requests can be honoured through us today, not once our revenue grows.
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no "Do Not Sell" flow because there is nothing to opt out of.
- We do not use consumer data to profile individuals or to make automated decisions about them.
- Requests about vehicle-buyer data go to the dealership, which is the controlling business. The tools to answer them are built into the product — see Section 4.
- Requests about your own data, where you dealt with us directly, come to us.
The same posture is applied to the equivalent statutes in Virginia, Colorado, Connecticut, Utah, Texas and the other states that have followed; we have not written a separate section for each because our answer does not vary by state.
3. GDPR — including the gap
Our marketing site is published in ten languages and our Terms contain a consumer-withdrawal section for the European Economic Area. We are therefore not in a position to say GDPR does not reach us, and we are not going to pretend otherwise.
- Where we hold data as a controller — your signup, demo, and billing details — we honour access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and we respond within one month.
- Where we hold data as a processor — your employees, your customers — we act on the controller’s instruction and support them in answering. The dealership is the controller.
- Transfers to the United States rely on the European Commission’s Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum. A Data Processing Addendum incorporating them is available from legal@thedasboard.com.
- We make no solely automated decision producing legal or similarly significant effects. Section 6 of the Responsible AI page explains why that remains true of a product that ranks named employees.
What we do not have, in Europe
We have not appointed a representative in the Union under Article 27 GDPR, and we have not designated a statutory Data Protection Officer. Neither is a formality we have overlooked; both are on the list of things this company has not yet done. If you are an EEA-established customer for whom either is a condition of purchase, tell us before you buy rather than after — the Privacy Policy records the same position, and legal@thedasboard.com will get a straight answer about the timeline.
4. Answering a consumer's request
When one of your customers asks what you hold about them, or asks you to erase it, the work does not come to us as a support ticket. Two database functions do it, and your own people run them:
| Operation | What it does | Who can run it |
|---|---|---|
export_deal_pii() | Returns everything we hold about that person on the deals you identify: name, VIN, deal number, and date | dealership administrators, general managers, group administrators, and our master administrators |
anonymize_deal_pii() | Erases the name and full VIN from those deals while leaving the financial and staff data intact, so commission history and totals are not corrupted by an erasure request | dealership administrators, general managers, group administrators, and our master administrators |
Both are restricted to deals inside the caller’s own dealership. A request naming a deal outside it is refused by the database, not by the interface.
5. Retention, enforced by scheduled jobs
These are not target periods. Each row is a job running on a schedule in the database:
| Data | Period | How |
|---|---|---|
| Vehicle-buyer name and full VIN on a deal record | Erased seven years after the deal date | Monthly job `anonymize-old-deal-pii`; the deal’s financial and staff data is kept so commission history stays intact |
| Showroom-visit name and partial phone number | Erased ninety days after the visit | Daily job `anonymize-old-lead-ups`; the visit is still counted, only the identifying fields are cleared |
| Prospect contact records our own sales team collected | Deleted after one hundred and eighty days | Daily job `purge-marketing-leads` |
| IP addresses in audit and demo-access logs | Cleared after one year | Daily job `purge-old-audit-ips` |
6. TCPA and text messages
The product sends text messages to dealership staff — schedule changes, alerts, and similar. It never sends a text message to a vehicle buyer, and it has no feature that would let it.
- Recipients are resolved from the staff directory of the sending user’s own dealership. There is no way to type in an arbitrary number.
- Opt-in status is checked before a message is sent, and STOP and START replies are honoured through the carrier webhook.
- The outbound log stores masked numbers.
- Inbound webhooks are signature-verified in constant time and refused if verification fails.
The caveat, because the absolute would be false
"We only text people who have opted in" is not quite true, and we would rather write the true version. When a dealership bulk-imports its staff roster, the first message we send to each new person is the opt-in solicitation itself — sent to a number their employer supplied, before that individual has agreed to anything. It is a business-to-business message to an employee's work contact, sent at the employer's instruction, and we think that is a defensible position. It is not the same as the absolute claim, so we are not making the absolute claim.
7. Sub-processors
Every outside company that receives data through the running product. The same table is in Section 8 of the Privacy Policy, rendered from the same source, and a unit test fails our build if a new external host is added to our security policy without appearing here.
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, file storage, realtime, and edge functions | All application data: accounts, dealership and staff records, pay plans, deals, schedules, and uploaded documentsSessions are held in the browser’s localStorage, not in a cookie. |
| Netlify | Website hosting, CDN, and the serverless functions behind checkout, email, and analytics | Every request to the site, including IP address and user agent, as web-server logs; whatever a given function handlesThe site is served from Netlify, so Netlify sees all traffic by construction. |
| Stripe | Subscription billing, checkout, and the customer billing portal | Billing name and email, card details entered directly into Stripe (never through our servers), subscription and invoice records |
| Google Analytics 4 | Website traffic measurement on the public marketing pages | Page views, referrer, approximate location, device and browser informationThe tag loads before you choose, but analytics and advertising storage stay denied until you grant them, so no analytics cookie is written first. |
| Sentry | Application error tracking and session replay | Error messages and stack traces, the signed-in user’s id and email address, role and dealership id as tags, and — for sampled sessions — a replay of the interfaceSession replay runs on roughly 1 in 10 signed-in sessions and on every session where an error occurs. In a product that displays pay, that is a processing activity worth naming rather than burying. |
| Zippopotam.us | Turning a ZIP code into a city and state during signup and onboarding | The ZIP code you type. Nothing else — no name, no account identifier. |
| Browser push services (Google, Mozilla, Apple) | Delivering browser push notifications to staff who have enabled them | An encrypted notification payload, routed to whichever push service the recipient’s own browser nominatedWhich company receives it is chosen by the recipient’s browser, not by us: Chrome nominates Google, Firefox Mozilla, Safari Apple. |
| Anthropic | The AI Advisor — the language model that answers questions about your dealership metrics | Aggregated dealership performance metrics, including employee names with their individual deal counts and gross, the selected question, and prior advice for context. No customer or consumer data. |
| OpenAI | Alternative AI Advisor provider — supported in code, not currently in use | Would receive the same AI Advisor payload as Anthropic if enabledListed because switching a provider must not be the moment this page becomes wrong. |
| xAI | Alternative AI Advisor provider — supported in code, not currently in use | Would receive the same AI Advisor payload as Anthropic if enabled |
| Twilio | Text messages to dealership staff | The staff member’s mobile number and the message textStaff only. The product never sends a text message to a vehicle buyer. |
| Resend | Transactional email — invitations, welcome messages, verification codes, and alerts | Recipient email address, name, and the message content |
| OCR.space | Reading a business card photograph into contact fields | The photograph of the business card, and therefore whatever is printed on itUsed only by our own sales team, on cards collected while selling this product to dealerships. Nothing in a dealership customer’s workflow reaches it. |
| Lead-research providers (Google Programmable Search, ScraperAPI, ScrapingBee, DuckDuckGo) | Finding dealerships to approach about buying The DAS Board | Search queries about dealership businesses. No customer data and no subscriber data.This is our own outbound prospecting, not a processing activity performed on a customer’s behalf. Listed for completeness because the code exists. |
Permitted by our content security policy but unused, disclosed so that our configuration and this page cannot disagree: NHTSA vPIC, Google Fonts.
8. Certifications and attestations we do not hold
- SOC 2 Type I or Type II
- ISO/IEC 27001
- PCI DSS certification in our own right (card data is handled entirely by Stripe, which is PCI DSS Level 1)
- An independent third-party penetration test
- A funded bug bounty programme
- A statutory Data Protection Officer
- An EU representative under Article 27 GDPR
- A contractual uptime commitment or credit-backed service level agreement
Our infrastructure providers hold their own certifications, which are theirs to represent rather than ours. If your review needs them, read them at the source — Supabase, Netlify, and Stripe each publish theirs.
If your procurement process needs a completed security questionnaire, a Data Processing Addendum, or a call with whoever wrote this, legal@thedasboard.com reaches a person and not a queue.