DATA MINIMIZATION + ACCESS CONTROL

Data & security.

What your workspace holds. How access works. The infrastructure behind your desk.

Structure & TrackLine forms: No dedicated SSN or driver’s-license fields
Connections and storage: HTTPS/TLS + managed encryption at rest
Access: WorkOS identity + server-side permissions

01 / CUSTOMER DATA

A focused set of deal inputs.

Structure and TrackLine’s customer-entry forms have no dedicated fields for Social Security or driver’s-license numbers.

Customer and co-buyer: Names identify the people on the deal. Optional email addresses and phone numbers support contact and document delivery.
Registration and location: State, ZIP, city and county support registration and tax jurisdiction. New York tax details also include a registration street-address field, which is retained with the saved deal.
Vehicle and deal: Vehicle and trade details, including VINs, sit alongside deal structures, lender, term, tier, rates, selected products and recorded results.
Notes and uploaded content: Notes, messages, imports and uploaded documents can contain information beyond the dedicated form fields. Keep unnecessary sensitive information out of these inputs.

PII-light still includes personal information. Names linked to location, vehicles and financial transactions identify people; a focused form does not limit everything a user may upload or enter. See our Privacy Policy for data use, sharing and privacy requests.

02 / ENCRYPTION

In transit. At rest.

Encrypted connections and managed storage provide different layers of protection.

WEB APP CONNECTIONS

HTTPS / TLS

Web app connections use HTTPS/TLS to encrypt data in transit between your browser and the service.

MANAGED STORAGE

AES-256

Supabase provides AES-256 encryption at rest for the managed database and file storage infrastructure we use.

Storage encryption describes our provider’s infrastructure. It works alongside application authentication and permissions. Read Supabase’s security documentation.

03 / ACCESS & DOCUMENTS

Identity, roles and delivery.

Available views and actions depend on the workspace, role and workflow.

Sign-in and server-side checks

WorkOS powers sign-in. SummitDesk’s server-side controls include session-token validation, active dealership membership checks and checks for role permissions. Additional sign-in verification settings are available.

Document access and sharing

Document Locker uses authenticated storage access to request time-limited download links. Anyone holding an issued link can use it until it expires.

Assigned quote reprints use the stored quote and a customer-facing download path. SummitValue presentation viewing requires sign-in. Handle downloaded files and delivered copies under your store’s own sharing policies.

04 / INFRASTRUCTURE

The services behind SummitDesk.

These providers support specific parts of the platform. Application permissions and data handling remain SummitDesk’s responsibility.

This is a selected infrastructure list. Features such as AI tools, document rendering and payments use additional service providers; relevant inputs may be processed by those services. Our Privacy Policy explains the broader data practices. Provider certifications and reports apply to their own services and do not certify SummitDesk.

FOR YOUR STORE’S REVIEW

Have a specific question?

Tell us which data or workflow your team needs to evaluate. Please keep customer records and credentials out of your message.

Contact SummitDesk Report a security issue