Security
How we protect dealership and customer data.
Encryption
All traffic to and from DealerFlow is encrypted in transit via TLS. Data at rest — deal records, documents, and backups — is encrypted at rest by our infrastructure providers (Supabase Postgres and Storage).
Authentication & access control
Sign-in is handled by Clerk, a dedicated identity provider — we never store passwords ourselves. Every user belongs to a role (salesperson, finance manager, sales manager, GM, or admin) that determines what they can see and do; administrative actions like inviting a teammate or changing exception thresholds are restricted to admins.
Audit log
Every create or update in the system — a stip marked received, a delivery rescheduled, a deal reassigned — is written to a permanent activity log naming who did it, what changed, and when. Nothing is overwritten silently.
Tenant isolation
DealerFlow is multi-tenant: every dealership's deals, deliveries, documents, and activity are scoped to that dealership alone. Every request is authenticated against the caller's own dealership, and application routes are built so that a request can only ever read or write data belonging to the organization the signed-in user is a member of.
Backups
Our database is backed up automatically by our hosting provider on a regular schedule, with point-in-time recovery available, so a bad deploy or accidental deletion doesn't mean lost deal history.
Incident response
If you believe you've found a security issue, or you're a customer who needs to report a suspected incident, contact us immediately at hello@proudstars.com. We investigate all reports and will notify affected dealerships without undue delay if an incident is confirmed to have affected their data, consistent with our obligations under PIPEDA and applicable breach-notification law.
Subprocessors
These are the third parties who help us operate the Service and may process personal information on our behalf.
| Subprocessor | Purpose |
|---|---|
| Supabase | Database (PostgreSQL) and file storage for deal, delivery, and document data |
| Railway | Application hosting for our API and web services |
| Clerk | Authentication, user accounts, and organization/role management |
| Twilio | SMS notifications to customers and dealership staff |
| Sentry | Application error monitoring, to help us detect and fix issues quickly |
We'll update this list if that ever changes materially, and notify Dealer account administrators of significant additions.