Cloud DMS vs Desktop Software: An Honest Comparison

Most independent dealers end up running their store one of three ways. Some buy a dealer management system (DMS) that lives on a PC in the back office. Some assemble a patchwork: one tool for inventory, another for the website, a spreadsheet for the pay-here notes, QuickBooks for the books, and a lot of copying and pasting between them. Some run everything in a browser on a hosted platform. This article makes the case for the third option, but it is going to be honest about where that case is weak, because the version of this article you usually find online is marketing dressed up as analysis.

Note: This is general information, not legal advice. Pricing and regulatory details change, so confirm current figures with each vendor and talk to your attorney or state dealer association before relying on anything here. Prices quoted were checked on vendor pricing pages in August 2026. Last reviewed August 2026.

First, a correction to the usual pitch

The standard cloud sales pitch treats "desktop" as a synonym for "obsolete," and it usually picks on Frazer as the example. That framing is wrong on the facts, so let us clear it out of the way before making any argument that depends on it.

Frazer publishes two tiers on its own pricing page: Desktop at $129/month and Hosted at "Starting At $199/month." The hosted tier puts your database on a remote server that Frazer manages. Both tiers list the same feature set, including Buy Here Pay Here and a full accounting suite, and the page states there are "no setup costs or hidden fees." Frazer says it is used by over 19,000 dealers across all 50 states, and it has been in business since 1985.

So Frazer is not desktop-only, it is not missing accounting, and at $129 a month it is not expensive. Its forms library is genuinely deep, and support is included rather than sold as a tier. Any article telling you otherwise has not read the vendor's website. We publish a detailed Frazer comparison that says the same thing.

The real distinction is narrower and more useful: is the software native to the browser, or is it a Windows application that you either install locally or reach through a remote session? Frazer's own help documentation describes Hosted Frazer as running the Frazer software on a cloud server, reachable from any Windows PC, and from a Mac via Microsoft Remote Desktop with limited support. That is a legitimate architecture with real advantages, including offline resilience and decades of hardening. It is simply a different one from software written for the browser from the start, and the difference shows up in specific, checkable ways.

The Windows problem is real, and it has a date on it

If your DMS is a Windows application, your software strategy is downstream of Microsoft's release calendar. That stopped being theoretical in October 2025.

Microsoft's lifecycle documentation confirms that Windows 10 reached end of support on October 14, 2025, with version 22H2 as the final release. Microsoft's Extended Security Updates page states exactly what stopped on that date:

• Technical support
• Feature updates or new features
• Quality updates, "including security and reliability fixes"

To be fair about it, Microsoft is equally clear that "Windows 10 PCs will continue to work." Nothing switched off. Your machine did not stop booting, and your DMS did not stop running. The change is that nobody is patching the operating system underneath it anymore.

That matters more than it used to. Verizon's 2026 Data Breach Investigations Report, published May 19, 2026, found that 31% of all breaches now start with vulnerability exploitation, and says this is "the first time in 19 years that it has surpassed stolen credentials as the biggest point of entry." An unpatched operating system is precisely the category of exposure that statistic describes. (Verizon notes the report uses 2025 data, and its sample skews toward larger organizations, so treat it as a direction of travel rather than odds for your specific lot.)

The escape hatches are narrower than they look

There are three ways out, and each has a catch worth knowing before you plan around it.

Buy Extended Security Updates. For businesses, Microsoft prices ESU through Volume Licensing at $61 USD per device for Year One, and states "the price doubles every consecutive year, for a maximum of three years." It is also cumulative: "If you decide to purchase the program in Year Two, you have to pay for Year One too." By our own arithmetic, not a figure Microsoft publishes, that is $61 plus $122 plus $244, or $427 per device to reach the end of the program. And Microsoft answers the obvious follow-up directly: "No, technical support isn't included in the ESU program."

There is a cheap consumer ESU route, but Microsoft's consumer program excludes domain-joined and MDM-managed devices and says it cannot be used in commercial scenarios. A dealership should not plan around it.

Upgrade the PC to Windows 11. Often you cannot, on the hardware you own. Windows 11 requires TPM 2.0, UEFI Secure Boot capable firmware, and a compatible processor, which is defined by a published list rather than by speed. Microsoft's supported Intel processor list for 24H2 starts at 8th Generation Core. A perfectly functional office PC can be ineligible.

Force Windows 11 onto unsupported hardware. Microsoft's guidance is that such devices "aren't guaranteed to receive updates, including but not limited to security updates", and that resulting damage is not covered by warranty. That forfeits the only reason you were upgrading.

And Windows 11 does not end the cycle. Each annual version has its own end-of-servicing date: per Microsoft's Windows 11 lifecycle page, version 24H2 goes out of service on October 13, 2026, with 25H2 following in October 2027.

None of this makes desktop software bad. It makes it a recurring capital and planning decision that browser-based software simply does not generate. When your DMS runs in a browser, Microsoft's calendar is Microsoft's problem.

What the patchwork actually costs

The second setup, the assembled one, is the most common and the least examined. It rarely arrives as a decision. It accumulates.

The cleanest evidence for what that accumulation costs comes from a competitor's own published price list, which is why it is worth citing rather than a vendor-funded "SaaS sprawl" study. DealerCenter publishes per-module pricing: the DMS is $99/month, Buy Here Pay Here is $50, Integrated Accounting is $99, CRM Plus is $99 (CRM Pro is $199), a Premium Website is $99, and valuation books are priced individually at $64/month each for Kelley Blue Book, Black Book, and Manheim Market Report, and $74 for J.D. Power.

Be fair about what that means. Modularity is a legitimate design: a dealer who only needs the DMS pays $99, and that is a good deal. But if you carry your own paper, keep your books in the system, work leads, run a website, and check two valuation books, you are assembling that bill yourself, one reasonable decision at a time. The question is not whether any single module is overpriced. It is whether you ever sat down and added them up.

Then there is the cost that never appears on an invoice: the data does not line up. When your inventory tool, your CRM, and your website each hold their own version of a vehicle, somebody reconciles them by hand, and somebody eventually sells a car that is already sold. Cox Automotive's 2024 Power of Data Study reported that 54% of dealers experienced conflicting data across multiple sources. Cox sells integrated dealership software and the study skews toward franchise stores, so weigh it accordingly. It still matches what anyone who has run a patched-together lot will tell you.

Access to your own data can also carry a price. In January 2025, Reuters reported that CDK agreed to pay $630 million to settle antitrust claims brought by a class of 243 software companies that had purchased data integration services since October 2013. The vendors accused CDK of "cutting off access to auto dealer systems and driving up prices vendors pay to access data for their apps." CDK denied any wrongdoing in agreeing to settle.

Two honest caveats. The plaintiffs were software vendors, not dealerships, so this is not evidence that dealers were billed directly, only that access to dealer data was a paid and contested commodity, with those costs landing somewhere. And CDK operates at franchise scale, not on 40-car independent lots. The lesson is structural rather than numeric: when your records live in a system whose owner controls who may read them, integration is a lever someone else holds.

Compliance is where the argument gets serious, and most careful

If you finance, arrange financing, or lease vehicles for longer than 90 days, the FTC's position is that you are a "financial institution" under the Safeguards Rule. We cover the full obligation in our guide to dealer data security requirements. Three provisions bear directly on how your software is delivered.

Encryption at rest. 16 CFR 314.4(c)(3) requires encryption of customer information both in transit over external networks and at rest. A local database on an office PC holding deal jackets, credit applications, and scanned licenses is customer information at rest. Encrypting it is your obligation either way. The practical difference is who operates and evidences the control.

Multi-factor authentication. 16 CFR 314.4(c)(5) requires MFA for any individual accessing any information system, not just remote users and not just admins. The only alternative is your Qualified Individual approving equivalent or stronger controls in writing. A shared Windows login on a back-office PC does not satisfy this by itself.

Logging who did what. 16 CFR 314.4(c)(8) requires monitoring and logging of authorized user activity to detect unauthorized access or tampering. Notably, this one is not waived by the small-institution exception in 16 CFR 314.6, which only exempts four provisions for institutions holding information on fewer than 5,000 consumers. That threshold counts consumers whose information you maintain, cumulatively, including past customers and applicants who never bought. A busy lot passes it faster than owners expect.

Now the part the cloud pitch usually omits

Moving to a hosted platform does not discharge any of this. It adds an obligation. 16 CFR 314.4(f) requires you to select service providers capable of maintaining appropriate safeguards, to require those safeguards by contract, and to periodically assess them. Your cloud DMS vendor is a service provider. So is every other tool you bolt on.

That is the most defensible version of the consolidation argument, and it is worth stating precisely: the regulation scales your oversight work with the number of vendors you use, not with their quality. Six tools means six vendors to vet, contract with, and reassess. It says nothing about whether any particular vendor is good.

Microsoft's shared responsibility documentation makes the same point from the technical side: under SaaS the provider takes on the operating system, network controls, and physical infrastructure, but the customer always retains responsibility for data, endpoints, accounts, and access management. Cloud moves the line. It does not erase it.

What the CDK outage proved, and what it did not

Any honest argument for cloud software has to deal with June 2024, and articles that skip it are not worth reading.

CDK Global, a cloud DMS, was hit by back-to-back cyberattacks on June 18 and 19, 2024, taking down the system that roughly 15,000 dealerships depended on. Stores went back to paper for about two weeks. Anderson Economic Group estimated direct dealer losses near $1.02 billion. AutoNation told the SEC the incident cut Q2 earnings by roughly $1.50 per share.

So no, the cloud is not magic, and "hosted" is not a synonym for "safe." What the outage actually demonstrated is concentration risk: when one vendor serves fifteen thousand stores, one incident becomes an industry event. That is a real cost of the model and you should price it in.

But it is a different risk from the one a single lot PC carries, and the failure modes are worth separating:

• When a hosted platform goes down, every customer is affected at once, it is public, and a funded engineering team is working on it with a strong commercial incentive to restore service. Your data is intact somewhere.
• When the PC in your back office is encrypted by ransomware, stolen, or simply dies, nobody else notices. There is no status page, no team, and no incentive but your own. Recovery depends entirely on whether your backups worked and whether you ever tested restoring one.

That second scenario is the one the joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide (2023) is written about. It tells organizations to keep offline, encrypted backups and to test restoring them regularly, precisely because ransomware operators hunt for and destroy reachable backups. A backup drive plugged into the machine it is backing up is reachable.

This is worth checking honestly against whatever you run today. Frazer's own help documentation, for instance, notes that in the installed configuration the automatic backup runs only if the dealership's server computer is powered on and awake, and that a local copy is written to that same machine. Frazer also offers online backups to its own servers, so this is a configuration question rather than a product flaw. But it is exactly the question to ask, and most dealers have never asked it of any of their systems.

There is one more asymmetry worth naming. Under 16 CFR 314.4(j), you must notify the FTC within 30 days of discovering a notification event affecting at least 500 consumers, a requirement in force since May 13, 2024. A "notification event" turns on acquisition of unencrypted customer information. Whether the PC that walked out of your office was encrypted is, at that point, a federal reporting question.

Where cloud genuinely wins

Strip out the marketing and a few advantages hold up.

Patching is somebody's full-time job. With the DBIR putting vulnerability exploitation at the top of the breach-entry list, the interval between a fix existing and a fix being installed is the thing that matters. CISA's small business guidance tells businesses to enable automatic updates wherever possible, noting it reduces the burden on staff and produces more consistent security. Browser-based software updates for every customer at once, without anyone at the dealership doing anything.

Strong authentication ships as a setting. On the widely repeated claim that MFA blocks 99.9% of attacks: that number comes from a single Microsoft blog post from August 2019 with no published methodology, and Microsoft's current documentation now states more than 99.2%, drawn from a 2023 study of Azure AD accounts. That is still an enormous risk reduction, and it is scoped to account-compromise attacks rather than all attacks. Either way, MFA is legally required of you. What matters is whether your system supports it centrally, which is a product question you should ask any vendor.

The work is not tied to a building. Appraising at auction, answering a lead on a Sunday, checking whether a car sold while you are at the bank: all of it needs the real system, not a phone call to whoever is standing near the PC.

One record, one truth. This is the quiet one. When inventory, the CRM, deal desking, title work, BHPH servicing, the website, and reporting all read and write the same records, a vehicle marked sold is sold everywhere at once. No sync, no reconciliation, no stale listing collecting leads on a car that left the lot on Tuesday.

For the record on scale: independent dealers are not a niche. NIADA's Used Car Industry Report put independent used-vehicle sales at more than 9.8 million in 2025.

How to actually decide

Ignore the category labels and ask about your own store.

Stay where you are if: your current system does what you need, you are comfortable with the hardware plan, your backups are tested rather than assumed, and the total across every tool is a number you have actually added up. A dealer running Frazer Desktop at $129 with tested online backups and a clear Windows upgrade path is in a defensible position, and switching for the sake of switching is a bad trade.

Look seriously at a cloud platform if any of these are true:

• You are running Windows 10 without an ESU plan, or on hardware that cannot take Windows 11.
• You have never restored from a backup to confirm it works.
• You are paying for four or more separate tools and have not totaled the bill in a year.
• You keep the same vehicle or customer in more than one place.
• You cannot answer, today, how you satisfy encryption at rest, MFA, and per-user activity logging.
• Work stops when a specific person is not at a specific desk.

Questions worth asking every vendor, cloud or not: Is customer information encrypted at rest, and how? Can I enforce MFA for every user? Is there a per-user audit log I can produce for an examiner? Can I export all of my data, in a usable format, without paying for the privilege? What happens to my data if I leave? Who is responsible for backups, and when did you last test a restore?

The bottom line

The strongest argument for a cloud dealer management system is not that desktop software is bad. Frazer has served dealers well since 1985 and does several things better than most of the market. The argument is that a browser-based platform removes an entire category of problems from your desk: the operating system lifecycle, the patch cadence, the backup that nobody tested, the fifth vendor to vet, the two systems that disagree about whether a car is sold.

It replaces them with a smaller, sharper set of concerns, chiefly vendor concentration and vendor oversight, and June 2024 proved those are real rather than hypothetical. That is a trade, not a free win. For most independent lots we think it is the right trade, and it is one you should make with the numbers in front of you.

If you want to see what consolidated looks like, our dealer management software runs inventory, CRM, deals, BHPH, titles, the website, and compliance tooling on one set of records, in a browser, with transparent pricing. You can start a free trial and judge it against your own lot. New to the category? Start with what a DMS actually is.