Dealership User Permissions: Who Should See What

Dealership user permissions decide which of your people can see, edit, approve or delete each kind of record: customer credit data, vehicle costs, deal paperwork, payroll and the books. The right setup is role-based. You give each job (salesperson, finance manager, bookkeeper, recon lead) only the access it needs, you turn on multi-factor authentication, and you review the list on a schedule. For a dealer who counts as a financial institution, this is also a federal requirement.

This guide walks through the roles most independent lots need, a starting permission matrix, the rules behind it, and a simple audit routine.

TL;DR

• Build permissions around job roles, not individual people. Each role gets the minimum access it needs to do its work.
• The FTC Safeguards Rule expects need-to-know access to customer information and multi-factor authentication for systems that hold it.
• Separate customer data (credit apps, IDs) from money data (vehicle costs, gross, ledger). Most staff need only one of the two.
• Review who has access every six months and remove departed employees the same day they leave.
• Vendors and outside accountants count as users too. Give them their own limited accounts, never a shared login.

Table of Contents

• Why permissions matter more on a small lot
• What the FTC Safeguards Rule requires
• Start with roles, not people
• A starting permission matrix for an independent dealer
• The permissions to look for in any dealer software
• Turn on MFA first
• Vendors, accountants and other outsiders
• An audit routine that takes an hour
• Our perspective: protect the profit data too
• Where Loturn fits
• Common mistakes to avoid
• FAQ
• Sources

Why permissions matter more on a small lot

On a five-person lot, it is tempting to hand everyone the owner’s login. It is fast, nobody has to ask for anything, and nobody has to remember a second password. It also means a salesperson can see the full cost on every unit, a porter can open a customer’s credit application, and you cannot tell who changed a number.

There are three practical costs:

1. Margin exposure. If every salesperson sees purchase price, transport and recon on every car, negotiations and commission talks change. Some owners like that transparency. Most want to control it.
2. Customer data exposure. Driver’s license images, Social Security numbers and credit applications are the data regulators care about most.
3. No audit trail. Shared logins mean you cannot answer “who edited this deal after it was posted?” That question gets expensive at tax time or in a commission dispute.

Permissions fix all three, and a clean role setup takes less than an afternoon.

What the FTC Safeguards Rule requires

If you arrange financing or leasing, or otherwise act as a financial institution, the FTC’s Safeguards Rule applies to your dealership. The FTC’s dealer FAQ (last updated June 2025) covers how it applies to dealers. In plain terms, the access-related parts are:

• Limit access to customer information. Only employees who need nonpublic personal information (NPI) for their job duties should be able to reach it.
• Use multi-factor authentication (MFA). Anyone accessing a system that holds customer information should have to prove who they are with more than a password.
• Oversee service providers. If a vendor can reach your DMS or CRM, you are expected to check its security practices and require equivalent safeguards by contract.
• Keep a written program. The rule calls for a written information security program, and the FTC’s business explainer says to designate a Qualified Individual to run it.

The NADA dealer guide to the Safeguards Rule lays out a roadmap for meeting the requirements. Check your own situation with your attorney or compliance provider, because whether and how the rule applies depends on what your dealership does.

One practical point from the compliance manuals: a single password on a shared system does not satisfy a need-to-know standard. The NJ CAR and ComplyAuto manual describes secure access controls as technical and physical controls that authenticate users and permit access only to authorized people.

Start with roles, not people

Role-based access control (RBAC) means you define a handful of roles once, attach permissions to each, and then assign people to a role. When someone is promoted or leaves, you change one assignment instead of re-checking dozens of switches.

It suits independents for a simple reason: your staff already work in roles. If you want a deeper look at how administrators put this into practice, this walkthrough on implementing role-based access covers the mechanics in a general business context.

The NIST principle behind it is least privilege. The NIST small-business primer describes limiting access to only those individuals who need it to do their jobs. Two consequences follow for a dealership:

• Day-to-day work should not happen under an administrator account. The owner needs an admin login for setup, and a normal login for daily use.
• Access should be removed promptly when it is no longer needed.

A starting permission matrix for an independent dealer

This is an example, not a standard. Adjust it to your headcount. In a three-person shop, one person will hold several roles, and that is fine as long as each login belongs to one human.

A few notes on the matrix:

• Let recon staff add costs without seeing everything. Someone who enters a $450 detail invoice does not need to know what you paid for the car.
• Treat “delete” as its own permission. Deleting or voiding a posted deal should be limited to one or two people.
• Separate “approve” from “enter.” The person who keys in a vendor invoice should not also be the one who approves its payment.

The permissions to look for in any dealer software

When you evaluate a system, or audit the one you have, check whether it can do the following. Several dealer platforms publish their role models in public documentation, so you can compare. For example, DealerZone’s user management page explains that each user gets a role that determines what they can access. A dealer API guide shows the other common approach: individual toggles for viewing vehicles and similar actions when you add or edit a staff member.

Both approaches work. Roles are faster to manage and harder to get wrong. Toggles give you finer control, but they drift over time as people ask for exceptions. Whichever you use, look for:

1. Individual logins for every user, with no shared accounts.
2. MFA on every account that can see customer information.
3. Cost visibility controls, so you can hide purchase price and gross from sales staff.
4. Separate customer-data permissions from financial permissions.
5. Edit and delete restrictions on posted deals and ledger entries.
6. A change log that records who changed what and when.
7. Fast deactivation of a user without deleting their history.
8. Limited or read-only accounts for outside accountants, auditors and vendors.

If the software cannot do number 3 or number 4, you are left with workarounds. The compliance background in our research describes one: practitioners split documents into separate folders, for example credit applications in one place and repair orders in another, when software lacks per-file permissions. It works, but it relies on discipline instead of the system enforcing it.

Turn on MFA first

If you do only one thing this week, make it multi-factor authentication. The NIST Cybersecurity Framework small-business quick-start guide is aimed at companies without a security department, and it asks the right questions: are you restricting access to those who need it, and are you removing access when they no longer do?

For a dealership, MFA matters for the email account, the DMS or accounting platform, the CRM, your bank portal and any lender or floorplan portal that offers it. Start with the accounts that can move money or expose customer files. A text-message code is better than nothing, and an authenticator app is better still.

For more background on practical security steps for small firms, this guide to securing customer data affordably is a useful companion to the checklist above.

Vendors, accountants and other outsiders

The FTC FAQ is clear that service providers fall under your responsibility. If your outside CPA, a recon vendor, a marketing agency or an IT contractor can reach systems with customer information, you are expected to check their safeguards and put them in the contract.

In practice:

• Give each outside party a named account, never your own login.
• Limit the account to what the job needs: an accountant gets the ledger and reports, a photographer gets nothing but inventory photos.
• Set an end date when the engagement is short-term.
• Keep the contract or written agreement on file with the security terms.

Recon vendors raise one more point. If you pay them as contractors, your records need to tie their invoices to specific vehicles, which we cover in our per-VIN recon workflow for 1099 vendors. Keeping that vendor’s access to cost entry only is a good example of least privilege at work.

An audit routine that takes an hour

Permissions decay. People change jobs, a temporary exception becomes permanent, a former employee’s account sits active for months. The research we reviewed suggests practitioners prune privileges at least every six months, and the NIST guide above flags failure to remove access that is no longer needed as a gap to close.

A simple routine:

1. Export the user list from every system: accounting, CRM, DMS, lender portals, email.
2. Match it against payroll. Anyone who is not a current employee or an approved vendor gets deactivated.
3. Check each person’s role against what they actually do today.
4. Look for shared or generic logins such as “frontdesk” and replace them with named accounts.
5. Confirm MFA is on for every account that touches customer information.
6. Review the admin list. Two admins is plenty for most independents.
7. Write it down. Date, who reviewed, what changed. This fits the written program the Safeguards Rule expects.

On the offboarding side, make removal of access part of the termination checklist. The same day, not the next week.

Retention matters here as well. Removing a user should not mean deleting the records they created. See our guide to dealership document retention across FTC, IRS and DOJ rules for what to keep and for how long.

Our perspective: protect the profit data too

Most permission advice for dealers is about customer data, and rightly so. But in our work with independent dealers, we see a second category that gets less attention: the numbers behind each car.

When costs are scattered across texts, receipts and spreadsheets, there is nothing to permission in the first place. Everyone with a spreadsheet has everything, and nobody trusts the totals. We built Loturn around tracking every cost for each vehicle, from purchase price through transport and recon, so the profit on a unit is visible before it sells. Once costs live in one place, deciding who sees them becomes a real management choice instead of an accident.

Our view is that a dealer should be able to answer four questions at any time: who can see a car’s cost, who can change a posted deal, who can reach a customer’s personal data, and who was the last person to touch a number. If you cannot answer all four, your permissions are not finished.

We also think small lots should not pay extra for basic safeguards. That is why our plans include every tool for one flat monthly price, with bank-level encryption for your data and people who answer the phone when you have a question about how your team should be set up.

— Eric Dosset

Where Loturn fits

If your costs, deals and books are spread over a spreadsheet, a notes app and a generic accounting file, tightening permissions is hard because there is no single system to control. Loturn puts per-vehicle costs, inventory, accounting, CRM and deal paperwork in one platform, with free data import and onboarding support so you are not rebuilding from scratch. Plans run from $99 per month for Flipper to $349 for Dealer and $699 for Multi-Lot. During a trial, ask us how your staff roles should map to your team and what each person will see.

Common mistakes to avoid

• Giving the manager admin rights by default. Admin should mean user and settings control. Managers rarely need that.
• Sharing one login at the front desk. If it is shared, it cannot be audited.
• Forgetting the lender and floorplan portals. They hold sensitive data too. Our floorplan payoff checklist is a reminder of how many hands touch those payoffs.
• Letting one person enter, approve and post. Even in a tiny shop, a second set of eyes on posting prevents expensive errors. Our deal posting checklist shows what to verify before a deal hits the books.
• Treating the setup as one-time. Put the six-month review on the calendar now.

FAQ

What are user access permissions?

They are the settings that control what each person can view, create, edit, approve or delete in a system. In a dealership, they typically separate customer information, vehicle costs, deal paperwork and accounting. Good permissions follow the job, not the person.

How many admin accounts should a dealership have?

Usually one or two. Admins can change settings and add or remove users, so each extra admin raises the risk. The owner should be one, and a trusted manager or your Qualified Individual can be the other. Everyone else should use a lower role for daily work.

Do small independent dealers have to follow the Safeguards Rule?

The FTC’s dealer FAQ says the rule applies to automobile dealers that are financial institutions, and it does not set a blanket small-dealer exemption in the research we reviewed. Whether your lot qualifies depends on the services you offer, such as arranging financing. Ask your attorney or compliance provider to confirm.

How often should we review user permissions?

At least every six months, and any time someone changes roles or leaves. Departures matter most: deactivate accounts the same day. Keep a dated note of each review.

Should salespeople see what we paid for a car?

That is a business decision. Many owners hide purchase price and recon costs from sales staff and show only asking price, with managers approving deals that go below a set gross. Whatever you choose, apply it by role, and tell the team up front.

Sources

• Automobile Dealers and the FTC’s Safeguards Rule Frequently Asked Questions (FTC)
• FTC Safeguards Rule: What Your Business Needs to Know (FTC)
• A Dealer Guide to the FTC Safeguards Rule (NADA)
• NJ CAR + ComplyAuto Safeguards Rule Compliance Manual
• NIST SP 800-171 R3 SMB Primer
• NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
• User Management (DealerZone documentation)
• Dealership user permissions (Dealer Studio API docs)

Recommended

• Dealership Document Retention: Map FTC, IRS, DOJ Rules
• Stop Gross Surprises: Deal Posting Checklist for Used Car Dealers
• Ledger Ready Per VIN Floorplan Fee Accounting for Dealer Accountants
• Stop Commission Disputes with Exam-Ready Washout Sheet Accounting for Dealer Payroll