Security overview
Updated October 6, 2026
Test Drive Valet holds the record of a test drive on a dealership’s behalf: the customer’s contact details, images of their driver’s license, the agreement they signed, and a sanctions-screening result. This page explains how that information is stored, who can reach it, and what happens to it. It is written for a dealership’s IT or legal reviewer; the plain-language version for customers is the privacy policy.
Where the data lives
All data is stored with Supabase, on infrastructure in the United States (AWS, Ohio). Databases and file storage are encrypted at rest; every connection — from the iPad app, the customer’s phone, and the dealership’s browser — is over TLS. We do not run our own servers and nothing is stored on a laptop or a desk.
| What | Where | Who reaches it |
|---|---|---|
| Customer details, test-drive records, screening results | Postgres database | The dealership that took the check-in, through the portal and the app |
| License images, insurance images, driver photos | Private file storage | The same dealership, through links that expire in minutes |
| Signed agreements (PDF) and screening certificates | Private file storage | The same dealership, the same way |
| Logins | Supabase Auth | Passwords are hashed; we never see or store them |
| Card and bank details for billing | Stripe | Stripe only. Nothing about a payment method is on our side |
Each dealership is walled off from every other
Every record carries the dealership it belongs to, and the database itself enforces the boundary: a rule on every table (row-level security) means a login at one dealership cannot read, change or even count another dealership’s rows, whatever the software above it asks for. File storage uses the same rule — the folder a file sits in is the permission check. There is no “all customers” view anywhere in the product.
The check-in app never decides which dealership a record belongs to from what it sends; the server takes that from the login the device was signed in with. A tampered device can only write into its own dealership.
Who can see what
- A dealership’s staff see their own dealership’s records in the portal, and nothing else. Logins are created by Test Drive Valet for the dealership and can be switched off by us or by the dealership’s own admin.
- The customer sees only their own check-in on the screen in front of them. They are never shown a screening result; that is reported to the dealership.
- Test Drive Valet staff can open a dealership’s portal for support and setup. Every view of a license image, signed agreement or certificate — by anyone — is written to an audit log the dealership can see.
- Nobody can open a license image by guessing an address: files are reached only through links the portal mints per file, which expire within minutes.
What we collect, and why
Only what the test-drive record needs: contact details (so the dealership can follow up), the license barcode’s contents and images of both sides (identity and a lawful driver), the dealership’s agreement and the signature on it, the vehicle and salesperson, and optionally an insurance card image and a driver photo where the dealership has switched those on. The sanctions screen compares the name against the US Treasury’s public SDN list on our server; the list is refreshed nightly and the version used is recorded on each result.
We do not use the data for anything else. We do not sell it, share it, or use it to build profiles across dealerships. No advertising or analytics services run in the app.
How long it is kept, and deletion
Records are kept for as long as the dealership keeps its account, and the dealership decides. There is no automatic deletion. A dealership admin can delete a customer’s personal data from the portal at any time — license images and barcode data, contact details, address, photos and notes are removed and the name is cleared — while the signed agreement and the screening certificate are kept as the dealership’s legal record. A legal hold placed on a customer blocks deletion until it is lifted, and every deletion is logged with who did it and why.
When a dealership leaves, it can export everything — a spreadsheet of records plus every image and document — in one archive from the portal, and we remove its data afterwards.
The services behind the product
| Service | Used for | Sees |
|---|---|---|
| Supabase (US) | Database, file storage, login, server functions | All stored data, as our hosting provider |
| Resend | Email: the dealership’s lead to its CRM, manager recaps | The lead’s contents (name, contact details, vehicle) |
| Twilio | Text messages the customer opted in to, and staff alerts | The phone number and the message |
| Stripe | Billing the dealership | The dealership’s billing contact and payment method; no customer data |
| Netlify | Hosting the website and portal pages | No stored data; pages are static |
| Apple | Distributing the app; on-device barcode reading | Nothing — the barcode is read on the device |
Protections on the way in
- Every page sends a strict content-security policy: scripts load from two named hosts and connections go to one.
- Secrets (API keys, signing secrets) are kept in the hosting provider’s secret store, never in code or on a device.
- The customer-facing phone check-in is a write-only door: it can file a check-in and cannot look anything up, it is rate-limited per store and per address, and a store’s code can be replaced at any time.
- Webhooks from Stripe and from the website’s form are signature-checked before anything is written.
- Nothing in the server code logs a customer field.
What we are not, yet
We are not SOC 2 or ISO 27001 certified today. Two-factor authentication for portal logins is planned and not yet available. Where a dealership’s own policy requires either, tell us; we will share our timeline and this overview is offered for your reviewer in the meantime.
If something goes wrong
If we learn that customer data has been exposed, we will tell the affected dealerships promptly with what happened, what was affected and what we did, so they can meet their own obligations to their customers and regulators.