How OptiSight Protects Dealership Data
Dealership data is sensitive: pay plans, customer logs, sales performance, inventory positions. Below is a candid look at the controls in place today, the architecture choices we made, and the practices we follow to keep your information safe.
For our live compliance posture, audit documents, and subprocessor list, visit the OptiSight Trust Center.
SOC 2 Type 1 Attested
OptiSight has completed a SOC 2® Type 1 examination, performed by the independent audit firm Sensiba LLP. The report, issued as of July 21, 2026, covers the AICPA Trust Services Criteria for Security, Availability, and Confidentiality - an independent confirmation that the controls described on this page are suitably designed to protect dealership data.
Current customers and qualified prospects can request the full report through our Trust Center.
Security Pillars
Our approach is layered: secure infrastructure, strict access control, monitoring, and operational hygiene.
Cloud Infrastructure
- Hosted on a major U.S. cloud provider
- Automatic scaling with zero-downtime deploys
- Managed TLS certificates on all public endpoints
- Short-lived credentials for every deployment
Data Protection
- Encrypted at rest with managed keys
- Encrypted in transit via modern TLS
- Storage isolated per dealership group
- Point-in-time recovery from automated backups
Authentication
- Industry-standard password hashing
- Short-lived sessions with server-side validation
- Single-use, time-limited password reset tokens
- Continuous strengthening of stored credentials
Access Control
- Role-based permissions across the platform
- Per-rooftop data isolation enforced server-side
- Cross-enterprise visibility gated by explicit approval
- Sensitive actions limited to authorized roles
Secrets Management
- Credentials held in a managed secrets vault
- Routine rotation and removal of unused keys
- Least-privilege access for every service
- No secrets in source code or environment files
Monitoring & Logging
- Real-time error monitoring across the stack
- Audit trails on every API call
- User identity attached to every captured event
- Session replays masked to prevent PII leakage
Architecture in Plain English
A high-level summary of how a request flows through OptiSight.
- You sign in over a secure connection. We verify your credentials without ever seeing or storing your plaintext password.
- Your session is scoped to your role and rooftop. Every request is validated server-side, and access is limited to the data your account is authorized for.
- Your data is encrypted end to end. Information is protected in transit and at rest, with automated backups for point-in-time recovery.
Sub-Processors
We rely on a small, deliberate set of vetted third parties. Each has its own SOC 2 / ISO 27001 program and signed Data Processing Agreement with us.
| Provider | Purpose | Region |
|---|---|---|
| Google Cloud Platform | Hosting, storage, BigQuery analytics, secret management | United States |
| SendGrid (Twilio) | Transactional email (password resets, notifications) | United States |
| Sentry | Error monitoring and crash reporting | United States |
| Cloudflare | DNS resolution and edge network | Global |
| GitHub | Source-code hosting and CI/CD | United States |
Operational Practices
Secure Development
Every change is code-reviewed before deploy. Releases are tagged and tied to immutable container images so rollbacks are one-click.
Incident Response
Errors trigger real-time alerts. We aim to acknowledge production issues within 1 business hour and provide post-incident updates to affected customers.
Data Portability
Customers can request a structured export of their dealership data at any time. On termination, data is deleted within 30 days.
Personnel
Production access is limited to a named set of engineers. Each engineer's machine is encrypted and uses MFA-protected accounts.
Reporting a Security Issue
Found a vulnerability? We take responsible disclosure seriously and will acknowledge any report within 2 business days.
Please do not include exploit details in your initial email; we will respond with a secure channel for further discussion.