How your store's data is kept apart
How store data is separated, who can see what, how sign-ins work, and what we record.
The rule we build around
One store per session, checked on the server
A person signed in to a store can see that store and nothing else. The store is read from their session, never from something in the address bar or a form, so no amount of fiddling with a URL reaches another dealer's data.
Where a record does not belong to the signed-in store, the answer is that the record does not exist rather than that access is denied, so nobody can use error messages to map out what other stores have.
Access
- One account per person. Sign-ins are LeadLocate accounts shared with the CRM, so access is granted and removed in one place.
- Roles, not exceptions. Owner, manager and staff. A role decides what is possible, and the check runs on the server, not in the page.
- No self-service accounts. New sign-ins are created by us at an owner's request, which keeps the list of people with access accurate.
- Sessions expire. A portal session ends after a period of inactivity and a sign-in is asked for again.
Handling
- HTTPS everywhere. Every page and every feed address, with no plain-text fallback.
- Support visits are recorded. When our staff open your portal to help, the visit is logged as ours and never as your team's activity.
- Held-back fields stay held back. A hidden field is removed from the published file itself, not just from a page.
- Public feeds are public. A feed address is readable by anyone who has it. That is what makes it useful, and it is why the field controls exist.
What we hold
Vehicle data from your public website, your store's contact details, the names and work emails of the people you ask us to give access to, transport requests and the carrier correspondence attached to them. We do not collect shopper records, credit applications or payment details through this product.
If you stop working with us, say so and we stop publishing your feeds. Ask for your data and we will hand it over in the same format the feeds use.
Reporting something
If you believe you have found a security problem, tell us before you tell anyone else. Call 844-376-2274 or use the contact form and mark it urgent. We will confirm we received it and keep you updated while it is being fixed.
See your own inventory in a clean feed
Send us your store name and website. We will build a sample feed from your live inventory and walk you through it, with nothing to install and no change to your website.