Dealership Data Encryption: How It Works and Why It Matters

Every deal leaves a trail of personal information behind it. A copy of the buyer's driver's license. A date of birth on the credit application. Pay stubs, an insurance card, the payoff letter for the trade. Most of it gets typed into your software, some of it gets emailed to a lender, and some of it ends up as a photo on a salesperson's phone. Encryption is what keeps that information unreadable when it lands in the wrong hands. This guide explains how it works in plain words, where it protects you and where it doesn't, why a dealership in particular should care, and what we built into AutoDealer.io to protect your customers' records.

Note: This article is general information, not legal or security advice for your specific store. Laws change and vary by state, so talk to your attorney and your IT provider before you rely on anything here. Last reviewed November 2026.

If you want the legal side in depth (the FTC Safeguards Rule, breach reporting deadlines, how long to keep records), we covered it in Dealer Data Security: What the Law Actually Requires. This article is about the technology itself: what encryption actually does, and what it doesn't.

What a dealership is really holding

Most small businesses hold a name, an email address and maybe a card number. A used car dealership holds far more. A typical deal jacket can include:

• A driver's license number and date of birth
• Home address, phone number and employer
• Income figures, pay stubs and bank statements
• A credit application, often with a Social Security number on it
• Insurance details and the payoff on a trade-in loan

Those are the pieces someone needs to pass for your customer when applying for credit. That's why identity thieves want them, and why federal law treats a dealership that arranges financing as a financial institution.

And the information is rarely in one place. It's in your dealer software, in email threads with lenders, in the copier's memory, in a phone's camera roll, in a filing cabinet and on the laptop the finance manager takes home. Every one of those copies is a separate thing to protect.

Encryption in plain English

Encryption scrambles information with a key so that it reads as nonsense to anyone who doesn't have that key. The customer's license number goes in, and what gets stored is a string of random-looking characters. Put those characters together with the right key and the license number comes back out. Without the key there's nothing useful to read.

The math is not the weak point. AES, the cipher most modern software uses, is a federal standard (FIPS 197), and nobody is breaking a 256-bit AES key by guessing. When encrypted data does get exposed, the failure is almost always in how the encryption was applied, what was left out of it, or who got hold of the key.

Three different jobs all get called "encryption," and it helps to keep them apart.

In transit: protecting data on the move

When a salesperson enters a customer's details on a tablet out on the lot, that information travels over Wi-Fi and the internet to wherever your software runs. Encryption in transit (the "https" and the padlock in a browser's address bar, technically called TLS) scrambles it for the trip, so someone on the same network can't read it as it goes by. That matters more than it sounds at a dealership, where the customer lounge Wi-Fi and the office computers often share one network.

Most dealers already have this inside their software, because nearly every web app uses it now. Where stores fall short is everything that travels outside it: a credit application attached to an ordinary email, or a photo of a license sent by text message. Email is often encrypted between mail servers, but it lands in both inboxes as a readable attachment and stays there for years.

At rest: protecting data where it's stored

Encryption at rest protects information sitting on a disk. It comes in two levels, and the difference matters.

Storage encryption scrambles a whole drive. BitLocker on a Windows laptop and FileVault on a Mac do this, and good cloud hosts do it to their disks. It protects you when the hardware itself walks away: a stolen laptop, a server pulled out of a closet, an old drive sold for parts. It does nothing once the computer is on and someone is signed in, because at that point the drive unlocks and everything on it reads normally.

Field-level encryption goes a step further. The software encrypts the most sensitive individual pieces, like a driver's license number, before it ever saves them. Even someone holding a full copy of the database sees scrambled text in those fields. Think of storage encryption as a locked building and field-level encryption as a locked drawer inside it.

Passwords: hashed, not encrypted

Passwords are a special case. A well-built system never stores your password at all. It stores a hash: a one-way fingerprint that can confirm the password you typed is right but can't be turned back into the password. NIST's digital identity guidelines require that passwords be salted and hashed with a scheme designed to make each guess slow and expensive for an attacker.

A quick test for any vendor: if they can email you your current password, they're storing it wrong.

The key is the whole game

Encryption is only as strong as the protection around its key. A safe with the combination taped to the door isn't a safe. The FTC wrote this straight into the Safeguards Rule: for breach reporting, customer information counts as unencrypted if the encryption key was accessed by an unauthorized person (16 CFR 314.2). So when a vendor tells you your data is encrypted, the follow-up question is where the key lives and who can use it.

What encryption can't do for you

Encryption solves one specific problem: data that gets taken while nobody authorized is reading it. A lot of what actually goes wrong at dealerships is a different problem.

A stolen password opens everything. If a criminal signs in as your salesperson, the software decrypts every record for them, exactly as it would for the salesperson. Encryption can't tell the two apart. That's why sign-in protection (two-factor codes, one account per person, cutting off access the day someone leaves) matters as much as encryption does.

A fake email can still move money. In business email compromise, a message that looks like it came from a lender, an auction or a vendor asks you to send a payment to a new account. It accounted for more than $3 billion in reported losses in 2025, according to the FBI's Internet Crime Report. Encryption won't stop someone in your office from following those instructions. A phone call to a number you already had will.

Paper doesn't encrypt. A deal jacket left on a desk, a credit app in the recycling bin, a copier that kept an image of every license it scanned. The FTC has long warned that digital copiers have hard drives that store what they copy, scan and print, which matters the day a leased copier goes back.

Your vendors are part of your risk. Verizon's 2026 Data Breach Investigations Report found that 48% of breaches involved a third party, up 60% from the year before. Your customers' data is only as safe as the weakest company holding a copy of it.

Staff can paste data anywhere. The same Verizon report found the share of employees frequently using AI tools tripled in a single year, from 15% to 45%, and flagged unapproved tools as a growing source of data leaks. A salesperson who pastes a credit application into a free chatbot to tidy it up has just sent it somewhere you don't control.

Why a dealership should care

The law expects it

If you arrange financing, or lease vehicles for longer than 90 days, the FTC considers your dealership a financial institution (FTC dealer FAQs). Under the Safeguards Rule you must encrypt customer information both at rest and in transit over external networks (16 CFR 314.4(c)(3)). The rest of the requirements, and the narrow relief for small stores, are in our Safeguards Rule guide.

Encryption changes what a bad day costs

This is the part most dealers miss. The FTC's breach reporting duty applies to unencrypted customer information. And every state has its own breach law: all 50 states, plus D.C., Guam, Puerto Rico and the Virgin Islands, require businesses to notify people when their personal information is breached, and NCSL notes those laws commonly include exemptions for encrypted information.

So a stolen laptop with an encrypted drive, and the key still safe, may be little more than an equipment loss. The same laptop unencrypted can mean letters to every customer in the files, state notices and, at 500 or more customers, a report to the FTC that gets published. Exactly where the line falls depends on your state and on what was taken, so that call belongs to your attorney. The difference is real either way.

Your customers are trusting you with a lot

A buyer hands over a license and a pay stub because they want the car, not because they've inspected your filing system. A breach letter with your store's name on it is the kind of thing people remember and post about. In a business that lives on referrals and reviews, that's a cost no spreadsheet shows.

Where dealership data actually leaks

Most dealership exposure doesn't come from movie-style hacking. It comes from everyday habits, and most of them are cheap to fix.

If your dealer software still lives on a server in the back office, it carries its own version of these risks. We compared the two setups in cloud DMS vs. desktop software.

What AutoDealer.io does to protect your data

We built AutoDealer.io for dealers who would rather have this handled inside the software that already runs their deals than bolted on around it. Here is what our dealer data security covers, stated plainly, limits included.

Encrypted on the way, and in the fields that matter most

Every connection between your browser and the app is encrypted in transit. On top of that, the most sensitive fields are encrypted with AES-256-GCM before they're saved:

• Each customer's date of birth and driver's license number
• A business customer's EIN, and your dealership's own EIN
• The answers a shopper gives on your website's lead forms
• The secrets behind two-factor sign-in
• The keys to connected accounts, such as your bank and QuickBooks

This is field-level encryption on the most sensitive data, not on every column in the database. Passwords are never stored at all, only a one-way hash of each. The help center explains how customer birth dates and license numbers are protected and where your team sees them.

No Social Security numbers to lose

The app has no field for a customer's Social Security number, and the financing pre-qualification form on your website doesn't ask for one or run a credit check. Its answers are stored encrypted as well. Data you never collect can't leak.

Your records stay yours

Every dealership's records sit in one database, and the database itself only hands back the rows that belong to the dealership you're signed in to. The app connects with a database login that isn't allowed to skip that rule, so a request that isn't tied to your dealership gets nothing back, never another dealer's records. Stored documents aren't public either. When someone on your team opens a deal document, the app creates a private link that stops working after five minutes.

Sign-in protection that holds up

• Anyone can turn on two-factor sign-in with an authenticator app such as Google Authenticator, 1Password or Authy, and gets ten single-use recovery codes in case the phone goes missing.
• Continue with Google asks for the same code once two-factor is on.
• Codes come from the app, never by text message.
• Sign out everywhere ends a person's sessions on every device, and changing a password does the same.
• Deactivating someone who leaves signs them out everywhere and shuts off any Telegram chat or AI app they connected.

Two-factor is each person's own choice today, so an owner can't require it for the whole team. Ask everyone to turn it on. It takes a couple of minutes, and it's what stands between a stolen password and your customer list. Here's how to turn on two-factor.

Access by role, and a record of changes

There are four fixed roles: Owner, Admin / Manager, Sales and Accounting. The role decides the menus, the buttons and what the server will allow, so typing an address into the browser doesn't get around it. Salespeople don't see what a car cost or the gross on a deal until an owner turns that on. Owners and admin managers can search an audit log of recorded changes: who changed what, when, and on which record.

The AI works inside the same rules

The AI assistant only offers and runs what the signed-in person's role allows, checks the role again before a change is applied, and leaves cost and profit out of its answers for anyone who doesn't see them. Every change it prepares waits for a person's approval unless the owner's Autopilot setting covers that routine job, and anything involving money or anything that can't be undone always waits for a person. The chat on your public website reads public information only. Your team gets an AI tool that was built to sit next to customer data, instead of a free chatbot that wasn't.

What we don't claim

We don't hold a SOC 2 report, and we don't offer SAML single sign-on or SCIM today. No software makes a dealership compliant with the Safeguards Rule on its own: you still need a Qualified Individual, a written security program, a risk assessment and staff training. And we can't secure your own computers, email or network. Those stay with you and your IT provider. Our Security & Subprocessors page lists our practices and the providers we rely on.

Questions to ask any software vendor

Whoever holds your customer data, these are fair questions, and you're owed straight answers. The Safeguards Rule actually requires you to oversee the service providers that handle customer information.

1. Is my data encrypted in transit and at rest? Which fields get their own encryption?
2. Where do the encryption keys live, and who at your company can use them?
3. How do you keep my records apart from other dealers' records?
4. Do you support two-factor sign-in with an authenticator app?
5. Can I see who changed a record, and when?
6. When I deactivate someone, what happens to their access, including apps they connected?
7. What security reports or certifications do you hold?
8. How quickly, and how, will you tell me about a breach that affects my data?

A vendor who answers with "military-grade encryption" and nothing else is telling you something.

An afternoon's work for your store

1. Turn on two-factor sign-in for email first, then for every system that holds customer data.
2. Give every person their own login, and retire shared accounts.
3. Turn on BitLocker or FileVault on every laptop that leaves the building.
4. Ask the sales team to delete license and pay stub photos from their phones once the record is in your software.
5. Move guest Wi-Fi onto its own network.
6. Make it a house rule that any change to payment or wiring instructions gets a phone call to a number you already had.
7. Check your copier lease for what happens to its hard drive when the machine goes back.

None of that costs much. Most of it costs nothing.

Frequently asked questions

What is the difference between encryption in transit and encryption at rest?

Encryption in transit protects data while it moves between devices, such as from a tablet on the lot to your dealer software, so nobody on the network can read it on the way. Encryption at rest protects data where it's stored, on a disk or in a database, so a stolen drive or a copied database doesn't hand over readable information. A dealership needs both, and the FTC Safeguards Rule requires both for covered dealers.

Does encryption make my dealership compliant with the FTC Safeguards Rule?

No. Encryption is one requirement among several. The rule also calls for a Qualified Individual, a risk assessment, multi-factor authentication, access controls, staff training, oversight of your vendors and secure disposal of old records. Software can supply some of the technical controls, but the security program itself belongs to your dealership.

If my customer data is encrypted, do I still have to report a breach?

Often not, as long as the key wasn't taken too. The FTC's reporting duty covers unencrypted customer information, and it treats encrypted data as unencrypted if an unauthorized person accessed the encryption key. Many state breach laws have similar exemptions for encrypted data. The details depend on your state and on what was taken, so call your attorney before deciding anything after an incident.

Is AES-256 encryption secure enough for customer data?

Yes. AES is a federal standard, and a 256-bit key can't practically be broken by guessing. When encrypted data is exposed in the real world, the cause is almost always a stolen key, a stolen password or data that was never encrypted in the first place.

Should passwords be encrypted?

They should be hashed, which is different. A hash is a one-way fingerprint that can check a password but can't be turned back into it, and NIST's guidelines require passwords to be salted and hashed. If a vendor can show you or email you your current password, it isn't stored safely.

Does AutoDealer.io encrypt customer data?

Yes. Traffic between your browser and the app is encrypted in transit, and the most sensitive fields (each customer's date of birth and driver's license number, EINs, website lead form answers, two-factor secrets and the keys to connected accounts) are encrypted with AES-256-GCM before they're saved. Passwords are kept only as a one-way hash, and the app has no field for Social Security numbers.

The short version

Encryption does nothing visible for years, and then it decides how bad your worst day is. Put it everywhere customer data lives, protect the keys, and surround it with strong sign-in and sensible habits. If you'd rather have that built into the software that already runs your deals, see how AutoDealer.io protects dealership data, or start a free trial and look around for yourself.