How we approach security
Draft last updated October 20, 2026
Brokers hold sensitive information about the people they serve. This section describes the security features built into LeaseDash and, just as important, what we do not claim.
Plain statement: LeaseDash has not been audited or certified by any third party. We do not claim SOC 2, ISO 27001 or any similar certification. The features below are product capabilities, not guarantees that no incident can happen.
Security features in detail
Two-step sign-in
Accounts can require a second step at sign-in: a code sent by email, a code sent by text message, or a code from an authenticator app. Agency admins can require it for administrators and supervisors, and choose which methods are allowed.
Roles, groups and permissions
Every user is an Admin, Supervisor or User, which sets what they can see (everything, their team, or their own customers). Groups and per-person overrides add or remove access for individual screens and actions, such as exporting data or changing commissions.
Sensitive information hidden until revealed
Personal details such as credit-application information are masked by default. Someone with the right permission can reveal them, and each reveal is written to the audit log.
Audit log
LeaseDash records important actions: sign-ins and failed sign-ins, exports, permission and role changes, security policy changes, and reveals of sensitive information.
Automatic lock
The screen locks after an idle time that your agency sets, so an unattended device is not an open file. Repeated failed sign-ins temporarily lock the account.
Data deleted on schedule
Your agency chooses how long customer records are kept. Records past that period are scheduled for deletion.
Where the product is today
The public preview of LeaseDash runs with sample data stored in your own browser, and codes for two-step sign-in are shown on screen rather than sent. Protections that depend on a server, such as database-enforced permissions, encrypted storage and real delivery of codes, belong to the production service. [Update this section with accurate details before launch, and describe hosting, encryption and backups.] Ask us in a demo about the current status.
Helping brokers meet their obligations
Auto finance and leasing businesses are generally expected to protect customer financial information under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule. LeaseDash is designed to help brokers meet those expectations by providing access controls, two-step sign-in, logging, and data retention settings. Using LeaseDash does not by itself make an agency compliant, and this page is not legal advice. Your agency remains responsible for its own written security program and policies. [Attorney to review this wording.]
Shared responsibility
- Choose strong, unique passwords and turn on two-step sign-in for everyone.
- Give each person only the access their job needs, and turn off accounts when people leave.
- Reveal and export sensitive information only when needed.
- Check the audit log from time to time.
Reporting a problem
If you think you have found a vulnerability, or believe your account was accessed without permission, tell us right away at [security contact email]. We will look into reports promptly and will notify affected agencies of incidents as required by law and our agreements. [Add response commitments.]
See also our Privacy policy and Terms.