Before trusting a software provider with dealership data, ask for a current SOC 2 Type II report. It provides an independent examination of specified controls and how they operated over a defined period. Dealers should also ask which systems are covered, who can access their information, and how the provider monitors risks and responds to security problems.
Key Takeaways
- Your software provider may have access to some of your dealership’s most valuable information. Security belongs in the conversation alongside features and price.
- A SOC 2 Type II report provides independent examination of controls over time. Its scope and the period covered matter.
- Ask how the provider controls access, monitors risks, manages system changes, and responds when something goes wrong.
- PIVOT is backed by a SOC 2 Type II examined control environment. Prospective customers should request current assurance documentation to understand the coverage.
Your software provider may have access to some of the most valuable information in your dealership.
Customer data. Financial results. Service performance. Staff information. Inventory. Sales activity.
So why wouldn’t you ask how they protect your data before trusting them with it?
Dealers depend on software to connect departments, track performance, and make decisions that affect profitability. Cloud-based platforms, mobile applications, and integrations can put important information within reach of the people who use it.
They also put that information in the care of technology partners.
Choosing the right software provider is about features, price, and business value. It is also about trust. Before you give a provider access to your dealership’s information, you should know how they protect it.
What Are You Trusting Your Software Provider With?
Think about the information your dealership uses to serve customers and manage the business.
Customer records may include contact details, equipment locations, contract information, and service histories. Financial information can reveal revenue, costs, margins, and individual account performance. Service records show technician activity, parts usage, and recurring equipment problems.
Together, that information reveals how your dealership performs, where it makes money, and who it serves. Protecting it should be a priority.
The exact information a provider can access depends on the software, the integration, and the permissions you grant. Before granting access, make sure you understand how the platform connects to your systems and how it protects the information it collects.
What data will the provider receive? Who can see it? What can they do with it?
These are reasonable questions for any company asking to become part of your dealership’s technology infrastructure.
Ask Your Software Provider About SOC 2 Type II
A software company can tell you, “Your data is secure.”
A SOC 2 Type II report gives you something more concrete to evaluate.
SOC stands for System and Organization Controls. A SOC 2 examination evaluates safeguards relevant to security. Depending on its scope, it may also address system availability, accurate data processing, confidentiality, or privacy. An independent CPA firm performs the examination.
A Type II report examines whether the controls covered by the report were appropriately designed and worked as intended over a defined period.
That distinction matters. A provider’s assurance that “your data is secure” is a claim. An independent auditor’s examination provides evidence about whether those controls worked as intended during the period reviewed.
For a dealer evaluating a long-term software partner, that evidence is worth asking for.
However, a SOC 2 Type II report does not guarantee that a company will never experience a breach.
It also does not automatically cover every product, integration, or service the company offers. That’s why you should ask whether the report covers the software and services your dealership will actually use.
Five Questions Every Dealer Should Ask
Before giving a software provider access to your dealership’s data, ask these five questions.
1. Do You Have a Current SOC 2 Type II Report?
Ask whether the provider can make the report available for review and what period it covers.
The answer should help you understand how recently the controls were examined and whether there have been important changes since that period. Your IT team or technology advisor can help review the documentation.
Don’t stop at the provider’s claim that it has a SOC 2 Type II report. Ask to review it.
2. What Systems and Services Are Covered?
Make sure the report covers the software and services your dealership will use.
If you are purchasing an analytics platform that connects to your ERP, ask whether the platform and its supporting systems are included in the examination.
If the provider shares its cloud hosting company’s report, ask whether its own safeguards have also been independently examined. The hosting company’s report may cover the infrastructure without covering how the software provider manages access to your data.
You want to know what has been examined and who is responsible for protecting your information.
3. How Do You Control Access to Customer Data?
Ask who within the provider’s organization can access your dealership’s information, why they require access, and how that access is approved and removed.
Useful follow-up questions include:
- Is access limited according to a person’s responsibilities?
- Is multifactor authentication required for sensitive access?
- Are access permissions reviewed?
- Is access activity logged?
Your dealership should also understand the permissions it controls. Giving every user the same access may be convenient, but different roles call for different levels of visibility.
4. How Do You Monitor Security Risks and System Changes?
Software changes. People change roles. New connections are added.
Ask how the provider identifies vulnerabilities, addresses security problems, and reviews changes before making them to systems that handle your data.
The provider should explain its process clearly. Who is responsible? How are problems prioritized? How are changes tested and approved?
Protecting your information is an ongoing responsibility. The provider’s answers should reflect that.
5. What Happens If Something Goes Wrong?
Ask how the provider investigates suspected unauthorized access, contains the problem, and communicates with customers.
Who would contact your dealership? How would they reach you? What information would they share, and when?
Clarify what the provider would expect from your team as well. If your IT contact has a role in the response, that responsibility should be understood before a problem occurs.
Your Dealership Has a Role, Too
A provider’s security controls are part of the picture. Your dealership also makes decisions that affect how information is protected.
Assign access according to job responsibilities. Remove accounts when people leave. Review permissions when roles change. Follow the provider’s security requirements and make sure someone owns those tasks.
When reviewing a SOC 2 report, ask your IT team to identify any controls the provider expects your dealership to maintain. AICPA specifically identifies customer responsibilities as an important part of report review.
Both sides should understand their responsibilities.
PIVOT: Powerful Analytics. Serious Security.
At Pros Elite Group, we understand that dealers trust PIVOT with valuable business information. That trust comes with a responsibility to protect it.
Dealers rely on PIVOT for visibility into the service, sales, and financial KPIs that drive profitability and accountability. This information helps leaders identify opportunities, understand performance, and decide where to focus.
PIVOT is backed by a SOC 2 Type II examined control environment, reinforcing our commitment to protecting the systems and information entrusted to us.*
We encourage prospective customers to ask questions and review the appropriate assurance documentation. Understanding the scope, period covered, and applicable controls is part of making an informed decision about your software partner.
Frequently Asked Questions
Does a SOC 2 Type II Report Guarantee My Data Is Safe?
No. It provides independent evidence about specified controls and how they operated during the period examined. It does not eliminate every risk. Review the scope, findings, and customer responsibilities with your IT team or advisor.
Is a Cloud Hosting Provider’s SOC 2 Report Enough?
It provides useful information about the hosting environment, but it may not cover the software company’s own processes. Ask what assurance covers the application, access to customer information, and the provider’s responsibilities.
Should I Ask an Existing Software Provider These Questions?
Yes. These questions are useful when reviewing current providers as well as evaluating new ones. Start with platforms that handle sensitive information or connect to important dealership systems, and request current documentation.
Next Steps: Ask One More Question
When you evaluate your next software partner, ask what the software can do for your dealership.
Then ask one more question:
“What are you doing to protect our business?”
Powerful software should deliver valuable information. The company behind it should earn your trust.
Contact Pros Elite Group to learn more about PIVOT and request current SOC 2 Type II assurance documentation.
PIVOT. Visibility. Accountability. Results. Security.
*Prospective customers should request the current SOC 2 Type II report or appropriate assurance documentation to understand the scope, period covered, and applicable controls.
