Security

Introduction

Dealerloop answers, books and follows up a dealership's buyers and sellers, so we hold your business data and your customers' contact details, messages and documents. Protecting them is part of how we build and run the platform, not an afterthought.

This page sets out the technical and organisational measures Dealerloop Technologies Pty Ltd (“Dealerloop”, “we”, “us”) uses to protect the information we process for dealerships and their customers. It says what is in place today and what is still planned, in the same voice.

Compliance and certifications

Dealerloop is an early-stage company and does not yet hold a SOC 2 or ISO 27001 certification. We are working towards ISO 27001 certification, preparing for a SOC 2 Type II assessment, and working towards the ACSC Essential Eight baseline. We handle personal information consistent with the Australian Privacy Principles.

• ISO 27001Working towards certification
• SOC 2 Type IIPreparing for the assessment
• Privacy ActBuilt to the Australian Privacy Principles
• Essential EightWorking towards the ACSC baseline

The platform runs on Amazon Web Services, whose Sydney region is independently assessed against SOC 2, ISO 27001 and the Australian Government's IRAP. The core technical controls those frameworks require are in place today, set out below.

Infrastructure and data storage

• Everything runs on AWS in Sydney (ap-southeast-2): the database on Amazon RDS for PostgreSQL, documents in Amazon S3, applications in containers on Amazon ECS. Australian customer data is stored in Australia.
• AI replies are written in Australia too: Dealerloop's AI runs through Amazon Bedrock with Australian inference, so customer messages don't leave the country to be answered.
• Every AI agent runs in its own isolated runtime (Amazon Bedrock AgentCore).
• The whole environment is defined as code (Terraform), so every change to it is reviewed and repeatable.
• Production is kept apart from development and testing.

Network and platform security

• Public traffic enters through Amazon CloudFront and Cloudflare, which carry our DNS, security and delivery network; everything else sits in a private network behind an internal load balancer.
• Our team reaches internal systems only over a private network (Tailscale).
• TLS certificates are issued and renewed automatically (AWS Certificate Manager).
• Errors and unusual behaviour are tracked as they happen (Sentry).

Data protection

• All traffic is encrypted in transit over TLS.
• Data at rest is encrypted with keys managed in AWS Key Management Service, across the database, document storage and backups.
• Every file a seller or buyer uploads, a licence or rego papers, is scanned for malware before it's stored (Amazon GuardDuty).
• Signed deal pack documents carry a digital seal (SSL eSeal), so any later change to them shows.
• Secrets live in AWS Secrets Manager, never in code or in the browser.
• Every dealership's data is kept apart from every other's with PostgreSQL Row-Level Security: access across dealerships is denied by default at the database, not just in the application.

Access control

• Accounts are invitation-only: there is no public sign-up, and every account is created for a named person.
• Two-step sign-in (an authenticator app) is offered to every dealer user, and enforced for platform administrators.
• Our team signs in to AWS through company single sign-on (Google Workspace), with access controlled per service in AWS IAM.
• Role-based access with least privilege. Administrator rights are granted on our side and can't be given to yourself.
• Dealer staff can see their active sessions and sign out every other device in one click.
• A documented quarterly access reviewPlanned

Application security

• Every change ships through GitHub with pull-request review; production branches are protected against direct pushes and deletion.
• Every change is built, tested and deployed by automated pipelines (GitHub Actions), including end-to-end tests of the product in a real browser (Playwright).
• Applications ship as versioned container images from a private registry (Amazon ECR); internal packages come from a private repository (AWS CodeArtifact).
• An annual independent penetration testPlanned

Logging and monitoring

• Administrative actions write to an append-only audit log: who, what, which record and when.
• Dealers see their own change history: every settings change records who changed what, and when.
• Errors are tracked as they happen, and our team monitors service health and the delivery of every message.

AI and your data

Customer messages are processed by Dealerloop's AI to write replies, inside AWS in Australia. They are never used to train AI models. Lead data is used only to engage and qualify that dealership's enquiries, on the dealership's behalf.

Messaging compliance

Messaging compliance is built into the product itself, on by default for every dealership.

• Spam Act consent
• One-tap STOP on every message
• Quiet hours
• AI disclosure: customers are told they're talking to Dealerloop's AI

Third-party providers

We keep the list short. Each provider is chosen for its own security programme and sees only what it needs to do its job.

We bill by invoice, so no card details are held anywhere in the platform.

Your data: export and deletion

• Export all of your leads and conversations at any time.
• Pause a dealership: processing stops and the records are kept.
• Permanent deletion on request: the dealership and everything linked to it is removed.
• A published data retention schedulePlanned

Incident response

If an incident affects your data, we notify affected customers without undue delay, consistent with our contracts and the Notifiable Data Breaches scheme under the Privacy Act, with what happened and what we've done about it.

• A formal incident response plan, tested once a yearPlanned

Availability and backups

• Applications run in containers that scale automatically with demand (Amazon ECS), behind load balancing.
• The database and documents are backed up automatically, in Sydney.
• Scheduled restore tests and a documented recovery planPlanned

Contact us

Questions about security, or running a vendor review? We'll complete your questionnaire and share the detail behind this page.

Email

[email protected]

Company

Dealerloop Technologies Pty Ltd · ABN 27 698 983 863