Every credit application your brokerage takes includes a Social Security number, a date of birth, a driver's license, income, and a home address. That is exactly the information identity thieves want. Once it lands in your CRM, keeping it safe is your responsibility, and a big part of that depends on the software you chose.
Most vendors will tell you they are "secure." That word means nothing on its own. This guide gives you 10 specific questions to ask any auto broker CRM or desking vendor, what a good answer sounds like, and the red flags that should end the conversation.
Why data security matters more for brokers
A typical small business stores names and emails. A brokerage stores full credit applications, co-applicant details, pay stubs, and copies of licenses. If that data leaks, your customers face real financial harm, and your brokerage faces lost trust, angry calls, and possible legal costs.
Brokers are also a busy target. Files move between staff, dealers, and lenders every day. Every PDF emailed, every shared login, and every spreadsheet on a laptop is another place the data can escape. Good software reduces how many of those places exist.
The FTC Safeguards Rule, in plain language
The FTC's Safeguards Rule, part of the Gramm-Leach-Bliley Act, requires many businesses that handle consumer financial information, including auto dealers, to run a written information security program. That program includes things like encrypting customer information, using multi-factor login, limiting who can see what, and overseeing the vendors you share data with.
If your brokerage arranges financing or handles credit applications, talk to your attorney about how the rule applies to you. Either way, the questions below map closely to what the rule cares about, so asking them helps you pick a vendor you can defend.
This section is general information, not legal advice.
10 questions to ask any CRM vendor
Ask these on a demo call or by email. A vendor that takes security seriously will answer each one directly. Vague answers like "we use industry-standard security" are not answers.
1. Are SSNs and driver's license numbers encrypted separately?
Almost every cloud service encrypts its disks. That protects against a stolen hard drive, not much else. Ask whether the most sensitive fields get their own extra layer of encryption, and where the key lives. A good answer: the fields are encrypted before they are saved, and the key is stored apart from the database, so a copy of the database alone is unreadable.
2. Who on my team can see a full SSN, and is it logged?
Your sales staff rarely need the full number. Ask whether SSNs are masked by default (for example, showing only the last 4 digits) and whether the system records who viewed or exported the full value and when. If something goes wrong, that log is how you find out what happened.
3. How is my data kept separate from other brokerages?
Most broker software is shared by many companies. Ask how the vendor makes sure another brokerage can never see your customers. The strongest answer is that separation is enforced inside the database on every request, not only by the app's screens, so a bug in one page cannot leak another company's files.
4. Can I require two-factor login for my whole team?
Stolen passwords are the most common way accounts get taken over. Two-factor login (a code from an authenticator app) stops most of those attacks. Ask whether you, as the owner, can require it for every staff member, and whether it is enforced on the data itself, not only on the sign-in screen.
5. What roles and permissions are available?
A finance manager, a salesperson, and an owner should not all see and do the same things. Ask what roles exist and who controls them. Avoid tools where everyone shares one login, because you lose all accountability.
6. How are uploaded documents stored and shared?
Pay stubs, licenses, and signed agreements are as sensitive as the application itself. Ask whether documents sit in private storage and whether sharing uses links that expire. A permanent public link to a customer's license is a leak waiting to happen.
7. Are my public forms protected from abuse?
Your credit application and lead forms are open to the internet. Ask whether the vendor rate limits them to block spam and automated attacks, and whether error messages are kept generic so they do not reveal how the system works.
8. Is any of my customer data sent to AI?
Many tools are adding AI assistants. Ask exactly what data those features receive. Customer records, SSNs, and credit applications should not be sent to an AI model unless you have clearly agreed to it. If your lender data license restricts where program data can go, ask about that too.
9. How are card payments handled?
If the software takes payments, card numbers should go through a PCI-compliant payment processor and never touch the vendor's own servers.
10. Whose security certifications are those?
Vendors often mention SOC 2 or ISO 27001. Ask whether the certification belongs to the vendor itself or to the hosting providers it builds on. Both can be fine, but an honest vendor will tell you which. While you are at it, ask how to report a security issue. A published security page and contact address are good signs.
Red flags that should end the conversation
The vendor cannot say whether SSNs get extra encryption, or says "everything is encrypted" and stops there.
Every staff member sees full SSNs with no masking and no log.
Two-factor login is not available, or you cannot require it for your team.
Your team is expected to share one login.
Documents are shared through links that never expire.
The vendor claims certifications but will not say whose they are.
There is no security page or way to report a problem.
How LeasingStack answers these questions
We built LeasingStack for brokerages that handle credit applications every day, so we hold ourselves to the same list. Here are our answers in short. The full details, and a two-minute video, are on our security page.
SSNs, Canadian SINs, and driver's license numbers are encrypted with AES-256-GCM before they are saved, on top of encryption at rest. The key is held only on our servers, separate from the database.
SSNs are masked to the last 4 digits by default. Every full view and PDF export is logged with who did it and when.
Each brokerage's data is walled off inside the database on every request.
Every staff member can use two-factor login, owners can require it team-wide, and it is enforced at the database level.
Staff have roles, from owner to sales, and owners and admins control access.
Customer documents and sent offers live in private storage and are shared through expiring links.
Public forms such as your credit application are rate limited.
Milo, our in-app assistant, only helps you use LeasingStack. It never receives customer records or SSNs, and lender program data and quote results are never sent to any AI.
Card payments go through a PCI-compliant payment processor.
Our hosting providers hold SOC 2 Type 2 reports and ISO/IEC 27001:2022 certification. Those certifications are theirs, and we build our protections on top of them.
Security you do not have to think about
Your customers trust you with their most sensitive information. LeasingStack puts your CRM, desking, and credit applications in one platform with these protections built in, so your team can work deals without emailing SSNs around. Every plan runs month to month and starts with a 14-day free trial.
Frequently asked questions
What security should an auto broker CRM have?
At minimum: extra encryption for SSNs and driver's license numbers, masked SSNs with a log of who viewed them, strict separation between brokerages, two-factor login you can require for your team, role-based permissions, private document storage with expiring links, and a published way to report security issues.
Does the FTC Safeguards Rule apply to auto brokers?
The Safeguards Rule covers many businesses that handle consumer financial information, including auto dealers. Whether it applies to your brokerage depends on what you do, such as arranging financing. Ask your attorney. This is general information, not legal advice.
Is it safe to email credit applications?
Email is a poor place for SSNs and full credit applications, because copies end up in many inboxes and are hard to delete. Keeping applications in a secure CRM and sharing through expiring links is much safer.
How does LeasingStack protect SSNs?
LeasingStack encrypts SSNs, Canadian SINs, and driver's license numbers with AES-256-GCM before saving them, with the key kept separate from the database. SSNs are masked to the last 4 digits by default, and every full view or PDF export is logged.
Does LeasingStack send customer data to AI?
No. Milo, the in-app assistant, only helps with using LeasingStack and never receives customer records or SSNs. Lender program data and quote results are never sent to any AI.