Integration, Data and Security in F&I

01One transaction, end to end

The table follows one financed vehicle service contract from the desk to its cancellation, possibly years later. The systems are categories; which vendor fills each slot varies by store.

Two things follow. First, by funding, one customer’s nonpublic personal information may sit in six or more systems run by different companies. The Safeguards Rule defines a service provider as any person or entity that “receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution,” and requires a covered institution to select, contractually bind and periodically assess its service providers (16 C.F.R. §§ 314.2, 314.4(f)). Ask your counsel which of the companies in this chain that definition reaches. Second, failures that cost dealers money can happen in the less visible steps 8 through 12, where a contract is registered, paid for, claimed on and cancelled. Step 12 is covered in Cancellations, Refunds and Chargebacks.

Steps 6 and 7 carry legal weight of their own. The E-SIGN Act bars denying a contract legal effect solely because it is electronic, but imposes consumer consent and disclosure requirements (15 U.S.C. § 7001(a), (c)). A lender buying an electronic RISC relies on UCC § 9-105, which in the pre-2022 versions we reviewed requires “a single authoritative copy” of the record. That is why eContracts sit in an eVault, and why fixing a product mismatch afterward is a lender process, not a keystroke. State versions vary, and several states have adopted the 2022 UCC amendments.

02The DMS landscape and how access is controlled

The dealer management system is the dealership’s system of record, and in practice a gate. A third party that wants to read deal data or write product data back usually goes through a program the DMS vendor runs, on terms it sets. The table covers the vendors whose ownership and access programs we could verify from their own material; we have left others out rather than describe them secondhand.

Whatever the program is called, it settles four things: which fields a vendor may read; whether it may write back, and to which records; what the vendor pays for access, and whether any of that reaches the dealer; and what the dealer must sign. The answer to “are you integrated with my DMS?” depends on all four, and can differ between two dealers on the same DMS.

03How the access fight ended

The DMS access litigation Part 01 mentions has now largely settled, and the outcome explains why integration works the way it does. Authenticom, a data integrator that extracted data from dealers’ DMS accounts using login credentials the dealers gave it, sued CDK Global and Reynolds and Reynolds in 2017 and won a preliminary injunction requiring access. The Seventh Circuit vacated it, holding that “the proper remedy for a section 1 violation based on an agreement to restrain trade is to set the offending agreement aside” (Authenticom, Inc. v. CDK Global, LLC, 874 F.3d 1019 (7th Cir. 2017)). The DMS vendors’ programs remained the controlled route to the data.

The related cases were consolidated as In re Dealer Management Systems Antitrust Litigation, MDL No. 2817 (N.D. Ill.). Dealers and vendors alleged that CDK and Reynolds conspired to restrain competition. CDK and Reynolds denied the claims, and the dealership-class settlement notice states that “the Court has not decided which side is right.” The resolutions we could verify:

The Wisconsin court also noted that earlier individual suits against CDK by Authenticom, Cox Automotive and MVSC “all settled years ago.”

State dealer-data laws

As of September 2026, we found no comparable statute in California, and other states may have provisions we did not find. In these three states the statute limits what a DMS contract can restrict (Oregon’s expressly voids conflicting terms). How a given clause in your DMS contract is affected, in these states or elsewhere, is a question to ask your counsel before you promise a vendor access.

04Aggregators and hubs, and who owns them now

Many administrators connect once to a hub, and the hub connects to menus and DMSs. Part 01 names the principal hubs. Since that list is often repeated without dates, here is what each company or its acquirer has published about ownership.

Each hub here is owned by DMS vendors, a lender-founded network, a data and analytics company, or an investor-backed software company. That is a description, not a criticism: a hub’s priorities and pricing are not set by your administrator, and an outage or change of terms at a hub can affect contracts you sell through several providers at once.

05API, batch, real-time: what the words mean

The same words describe very different mechanisms. This is what each usually means.

Integrations often combine these: rating by synchronous API, registration and remittance in a nightly file, and both called “integrated.” Neither design is wrong, but a contract rated in under a second may not exist in the administrator’s system until the next morning, and a cancellation may not reach the dealer until the next remittance cycle.

Ask for a monthly reconciliation of three lists: contracts posted in your DMS, registered by the administrator, and remitted. Any difference is a customer who may believe they are covered, a dealer who may have been billed for something never registered, or both. Who produces that report, and how often, tells you more than an architecture diagram.

06The Safeguards Rule as amended

The FTC states that the Safeguards Rule covers automobile dealers that extend credit through a retail installment contract, arrange financing or leasing for personal, family or household use, or lease vehicles for more than 90 days (FTC dealer FAQ, June 2025). The rule was substantially amended in 2021, with most new elements in force from June 9, 2023 after an FTC extension, and a notification requirement added effective May 13, 2024. Part 01 covers § 314.4(f).

The rule exempts an institution holding customer information on fewer than 5,000 consumers from § 314.4(b)(1), (d)(2), (h) and (i), but nothing else (16 C.F.R. § 314.6).

The notification requirement

Since May 13, 2024, a financial institution must notify the FTC “as soon as possible, and no later than 30 days after discovery” of a notification event involving the information of at least 500 consumers (§ 314.4(j)). A notification event is the “acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.” Information counts as unencrypted if the encryption key was also accessed, and unauthorized access is presumed to be acquisition unless the institution has reliable evidence otherwise (§ 314.2). The FTC has said it intends to put the reports in a publicly available database (88 Fed. Reg. 77499 (Nov. 13, 2023)). Section 314.4(j) provides for notice to the FTC. Notice to consumers is addressed by state breach statutes, which differ in triggers, deadlines and content; ask your counsel which apply to you.

Separately, for dealers within the FTC’s jurisdiction, the FTC’s Privacy Rule (16 C.F.R. Part 313), which the FTC’s 2025 dealer FAQ continues to point dealers to, governs sharing nonpublic personal information with nonaffiliated companies; some dealers may instead be subject to the CFPB’s Regulation P. The FTC’s Privacy Rule guidance for dealers describes exceptions for service providers under contract and for processing a transaction the consumer requested. Ask your counsel how those exceptions apply to the information you send to administrators, hubs and other vendors. This is a summary, not legal advice.

07State privacy laws and the GLBA exemption

Dealers often assume GLBA coverage takes them outside state consumer privacy laws. That depends on the state and on how its law is written. An entity-level exemption removes the whole business. A data-level exemption removes only GLBA-covered information and leaves other personal information subject to the state law.

California’s CCPA, for example, applies to businesses above statutory thresholds, including $26,625,000 in annual gross revenue as adjusted January 1, 2025; its provision on GLBA-covered information is Cal. Civ. Code § 1798.145(e). Other states’ exemptions may differ and may have changed, and we have not summarized them here because we could not confirm them against enacted text. Check the current statute in each state where you operate.

Under a data-level exemption, some of the data moving through section 01 may be exempt and some may not. Ask your counsel which of that data is covered by an exemption in each state where you operate, rather than assuming the whole deal jacket is.

08SOC 2 reports: what they tell you and what they do not

Part 01 recommends asking for a SOC 2 Type II report. A SOC 2 report is an independent CPA firm’s examination of a service organization’s controls against the AICPA’s Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are optional, chosen by the organization.

Where to look in the report

• The system description. A report on corporate IT says little about the rating or claims platform your data passes through.
• The categories. A security-only report does not address availability, which matters if you need claims lookup working on a Monday morning.
• The opinion. Unqualified, qualified, adverse or a disclaimer. Read which one it is.
• Testing exceptions. Listed control by control in a Type II. A small number is common; read what they were and management’s response.
• Complementary user entity controls. Controls the report assumes you have in place. If you have not implemented them, its conclusions may not hold for your use.
• Subservice organizations. Under the carve-out method, the vendor’s own vendors, such as a cloud host or hub, are excluded; under the inclusive method, included. Carve-outs are common and legitimate, but mark the report’s edge.
• The period. If it ended months ago, ask for a bridge letter.

09CDK, June 2024: what the public record adds

Part 01 summarizes the attack on CDK Global that began June 18, 2024 (roughly 15,000 dealer locations affected, about sixteen days to restore, one outside estimate of more than $1 billion in collective dealer cost). CDK is privately held, so much of the public record is what others filed. Beyond Part 01, we could verify:

• Public dealer groups disclosed it to the SEC. Filers in June 2024 included Lithia Motors, Group 1 Automotive, Sonic Automotive and Penske Automotive, according to trade reporting. Group 1’s June 24, 2024 exhibit stated that the incident “has disrupted Group 1’s business applications and processes in its U.S. operations” and that its U.S. dealerships “continue to conduct business using alternative processes.” Sonic Automotive later said, as reported by Cybersecurity Dive, that the incident was “reasonably likely to have a material impact” on its results.
• CDK filed a breach notice with the Maine Attorney General. CDK Global LLC’s notice reports an external system breach (hacking) occurring June 14–20, 2024, discovered June 19, with written consumer notice on September 20, 2024. It lists 36 total persons affected, one of them a Maine resident. It records that notification only; it does not describe whose information was involved or the scope of the outage, and we have not inferred either.

The lesson we draw is narrow. The dealers whose disclosures we read kept selling by working around the DMS. The question is not which vendor was attacked but whether each step in section 01 still works when the DMS does not. If a step has no path around the DMS, find that out before an outage does.

10Data ownership and portability on termination

Different rules govern different bodies of data.

Two points to consider when a relationship ends. First, an administrator may be required by state law to retain records (Texas § 1304.155 is one example), so ask what it must keep, for how long, and whether it will provide a complete export. Second, § 314.4(c)(6) calls for procedures to dispose of customer information no later than two years after its last use, subject to exceptions for business need, legal retention and infeasibility. Ask your counsel how that applies to copies held by former vendors, and ask each vendor which copies it will retain and which it will dispose of.

In-force contracts outlive the administration agreement. Ask how any termination arrangement preserves the customer’s ability to get a claim paid and your ability to process cancellations and reconcile what you are owed. See Cancellations, Refunds and Chargebacks and, for programs carrying your name, White-Label and Private-Label F&I Programs.

Where CareGard sits

For disclosure: CareGard’s programs are administered on TRONIX, the platform CareGard uses to administer its programs. As described on caregard.com/technology, its functions include OEM integrations, dealer and agent portals, reporting, program administration (rate tables, contract issuance, cancellation management and reinsurance accounting) and data exchange. That is a description of functions, not a claim about security or speed; ask us the questions in section 11 as you would any administrator. We mention it so you know where we sit in section 01. The questions in this guide apply to us as much as to anyone.

11An integration due-diligence checklist

These extend Part 01’s technology questions. Ask for the answers in writing.

12How we built this, and what we could not verify

We used primary sources wherever they exist, and labelled trade reporting and other secondary sources as such. What we could not verify:

• Later proceedings in the vendor-class settlement. We confirmed preliminary approval (April 29, 2025) only.
• Terms of the Authenticom settlements with CDK (2020) and Reynolds (2022).
• Dealer-data laws beyond Arizona, Oregon and Montana, and GLBA treatment under state privacy laws other than California’s.
• DMS market shares and typical integration timelines. We found no independent, current source.
• How § 314.4(j) applies to an event at a service provider. We leave that to your counsel.

Ownership statements are accurate as of their stated dates and September 2026; check again before relying on them. This is not legal advice. These rules and statutes apply differently to different businesses, and several changed in 2025 and 2026. Use this guide to ask better questions of your counsel and vendors, not in place of them. We intend to review it annually. If something here is wrong, we would like to know.