Safety & Compliance

DEOS Dealership Data Safeguards

Protecting Dealership Information Across Connected Systems And AI Workflows

I REVLAB, INC. | DEOS
Prepared by: DEOS Engineering, Management, and Legal Departments
Last Updated: November 4, 2026

01. Your Data Remains Under Your Authority

DEOS connects dealership systems to support authorized engagement, operational intelligence, and staff workflows. Those connections do not transfer ownership of dealership records or grant unrestricted use of customer information. We process dealership information for the agreed services, lawful dealership instructions, security, and applicable legal obligations. Access to a dealership's DMS or CRM is not permission to sell its information, distribute its customer relationships, or use its private business intelligence for another dealership.

Our safeguards extend to the Dealer Data Universe (DDU), including connected customer and vehicle records, communications, staff prompts, permissions, generated content, and associated retrieval indexes and processing context.

02. Authorized Connections To Dealership Systems

Our current DMS integration paths include Tekion through API integration; CDK Global through the Fortellis platform and Marketplace; Dealertrack through Cox Automotive; and Reynolds & Reynolds through Authenticom's DealerVault service. DealerVault also supports connections to other DMS platforms within its available coverage. A DealerVault-mediated connection is distinguished from a direct API connection to the underlying DMS.

For CRMs, DEOS supports lead delivery across the automotive CRM market through the destination's supported lead-intake methods. This lead-delivery capability is distinct from access to a CRM's underlying database. Our direct API integration paths include VinSolutions through Cox Automotive and DriveCentric. Scheduling integrations include Xtime through Cox Automotive and Dealer-FX through API integration.

The DEOS API framework also supports integration with other API-enabled DMS, CRM, scheduling, and dealership applications, subject to compatibility, vendor permissions, security review, and implementation validation. Each deployment confirms the actual vendor, connection method, permitted records, direction of exchange, and enabled operations.

Connections use authorized access mechanisms and must satisfy the applicable vendor security, privacy, authentication, and data-handling requirements. Credentials and access permissions are restricted to the approved purpose. Required controls must be validated before live use; changes in scope or access require review.

03. Defined Data Flows, Not Open Vendor Access

An approved connection does not allow a vendor to inspect all information held in DEOS, access another connected vendor's records, or obtain another dealership's data. We limit exchanges to the information and operations needed for the dealership-authorized workflow. Reading a service record, delivering a lead, and confirming an appointment are separate permissions.

We do not distribute dealership customer information among unrelated vendors or provide it for their independent marketing, model training, or commercial exploitation. Where a dealership authorizes synchronization between its own systems, the necessary exchange remains purpose-limited. Contracted hosting, delivery, screening, and other operational providers receive only the access needed for their approved role, under applicable confidentiality, security, and data-use restrictions. For example, a text provider needs a destination number and message to deliver an authorized text; that does not grant access to the DDU.

04. Separation Between Dealerships

Each dealership operates within a separately identified, access-controlled tenant environment. Enforced logical segregation protects dealership records, conversations, prompts, retrieval context, generated assets, and authorized actions. Shared underlying infrastructure does not authorize shared customer databases.

A user, agent, integration, or workflow acting for one dealership must not retrieve or reuse another dealership's information. These restrictions extend beyond the visible application to APIs, background processing, search indexes, caches, support access, and exports. Group, agency, and OEM access requires specific authority for the affected dealership environments; a common brand alone is insufficient.

We do not pool dealership DDU customer information into a cross-dealer customer dataset or use one dealership's confidential information to improve a competitor's targeting, pricing, or strategy. Common platform improvements remain subject to the exclusions and controlled development process in our AI Governance Policy.

05. Encryption, Access Protection, And Cybersecurity

DEOS maintains dealership information in a safeguarded cloud environment with encryption in transit and at rest, access restrictions, and security controls appropriate to the information and processing. Connected data is not automatically visible to every employee or every AI agent.

Our access-control standard requires role-based, least-privilege permissions; protected credentials and integration secrets; multifactor authentication for privileged and other applicable access; and review and removal of access when responsibilities change. Necessary support access is restricted to authorized personnel performing an identified service task.

Our security program addresses phishing, stolen credentials, unauthorized access, malicious inputs, and other cyber threats through layered authentication, personnel security awareness, controlled administrative access, monitoring, vulnerability management, and incident procedures. AI instructions do not replace backend authorization: a malicious message or document must not grant an agent new permissions or access to another store.

Material security concerns are investigated and contained, with affected workflows restricted when necessary. Incident response includes impact assessment, appropriate evidence preservation, corrective action, and notifications required by law and the applicable agreement. These controls reduce risk; they do not make a security incident impossible.

06. Private AI Processing And Controlled Actions

We do not use dealership private customer records, prompts, conversations, biometric information, or likeness assets to train shared or general-purpose AI models for unrelated customers. Protected DDU context must remain within the approved DEOS processing boundary and must not be routed to an outside shared AI application. Authorized infrastructure providers may operate Company-controlled workloads under the agreed restrictions; using cloud compute does not grant those providers independent AI-use rights.

Agents act within defined dealership permissions, approved tools, and commercial limits. Consent, suppression, recipient eligibility, and material source facts must be checked before affected communications or actions. Uncertain identities, conflicting records, or unavailable controls require a held action or appropriate human review. Dealerships maintain their source records; DEOS remains responsible for its own agreed processing and safeguards.

07. Ongoing SOC 2 Work And Independent Assurance

DEOS is currently undertaking a SOC 2 Type 1 readiness and examination project, including the documentation, review, and evidence supporting its access and information-security controls. The project is in progress. It is not represented as a completed independent SOC 2 report.

SOC 2 is an independent CPA attestation process resulting in a report, rather than a product certification. Type 1 addresses the system description and suitability of control design as of a specified date; it does not establish operating effectiveness over a review period. Any completed report will be described according to its actual scope and findings. A cloud or integration provider's audit does not substitute for DEOS's own examination.

08. Retention, Review, And Questions

We retain dealership information for its authorized purpose and applicable contractual and legal requirements, with return, deletion, access revocation, and backup handling governed by the Privacy Policy and Agreement. Likeness and biometric assets follow their separate, stricter retention and destruction schedule. Minimal consent and suppression evidence may remain where needed to honor customer choices or establish compliance.

This statement accompanies the DEOS Subscription Terms, Privacy Policy, AI Governance Policy, and TCPA Compliance And Communications Acceptable Use Policy. Those documents provide the detailed processing, security, communication, retention, and contractual provisions. Relevant diligence information can be requested through a controlled review that protects other dealerships' information and security-sensitive details.

Security, privacy, and diligence inquiries: legal@deos1.com
Support and suspected account compromise: support@deos1.com

Reference Resources

• AICPA & CIMA — System And Organization Controls resources.
• Fortellis — Authorizing API requests.
• Authenticom — DealerVault data access and feed controls.

Vendor resources describe their respective services and requirements; they do not independently verify DEOS implementation or confer a certification on DEOS.