Security & Data Protection
Last updated September 24, 2026
How Lot Greeter protects the dealerships that use it and the shoppers who talk to it. Written for dealer IT, OEM compliance teams and website-platform partners. Questions or a security questionnaire: brennen@lotgreeter.com.
- The camera is never used. The microphone turns on only after a visitor clicks Start video chat.
- No audio or video is recorded. We keep text transcripts only.
- No ad trackers, no cookies from the widget, and we never sell data.
- Each dealership's data is isolated at the database layer.
- Data is deleted within 30 days of an agreement ending, or of a request.
On the dealer's website
- One small script, served over HTTPS from a global CDN. The video-chat code loads only when it's needed. It doesn't include or depend on jQuery or React, and it sets no cookies.
- On Dealer.com sites, the widget runs through Dealer.com's Integrated Partner API. It verifies the Dealer.com-signed site token against Dealer.com's published keys before a page can use a dealership's account.
- The greeter tells visitors it's an AI before they choose video chat, says what's kept, and links to a privacy policy.
Data we handle
| Data | From | Kept |
|---|---|---|
| Conversation transcripts (text) | Website visitors | While the agreement runs, then deleted within 30 days |
| Leads: name, phone, email, vehicle | Visitors, only when they choose | Same; also delivered to the dealership by email or webhook |
| Microphone audio | Visitors, video chat only | Not stored. Streamed live for speech-to-text and the call |
| IP address | Every request | Not stored. Used in memory for rate limiting |
| Inventory and website content | The dealership's public site and feeds | While the agreement runs |
| Dashboard accounts | Dealership staff | Until removed, or the agreement ends |
| Aggregated statistics and de-identified examples | Derived from use, with nothing that identifies a person or dealership | May be kept after the agreement ends |
Isolation and access
- Row-level security is enabled on every table in our database. A dealership's users can read only that dealership's rows.
- Each dealership's search index lives in its own namespace.
- Public widget endpoints require the dealership's widget key, reject browser requests from websites that aren't the dealership's, and are rate-limited per key and client.
- Dashboard users have individual accounts with a role, either dealership user or Lot Greeter administrator. Administrator pages check that role on the server.
- Database service credentials are used only on the server, never in the browser. Production secrets live in our host's encrypted environment store, never in source code.
- Preview deployments require authentication. Only production is public.
Encryption and backups
- All traffic uses HTTPS (TLS).
- The database and its backups are encrypted at rest by our database provider.
- The database is backed up automatically every day.
AI guardrails
- The greeter answers vehicle questions only from the dealership's live inventory and website, and it says when it doesn't know.
- It never quotes payments, APRs, lease terms, trade-in values or discounts. Every reply passes a rules filter and an AI compliance classifier before a visitor sees it. A blocked reply becomes a hand-off to the dealership's team and is logged for review.
- New-vehicle prices that include manufacturer offers are described as including offers, with the offer end date, never as a discount amount.
- Every change runs an adversarial compliance test suite, live against the real models, before it ships.
Service providers
These providers process data for us, only to run Lot Greeter:
| Provider | What for | What it receives |
|---|---|---|
| AI model providers | The greeter’s replies, compliance checks, reading dealer websites, search over dealer content | Conversation text; dealer website and inventory text |
| Speech-to-text provider | Turning speech into text during video chat, outside Chrome and Edge | Microphone audio during video chat |
| Video and voice provider | The greeter’s video and voice, and the video call itself | Microphone audio during video chat; the greeter’s words |
| Search index provider | Search index of each dealership’s website content | Dealer website text; searches derived from visitors’ questions |
| Database and sign-in provider | Database and dashboard sign-in | Everything we store, including transcripts and leads |
| Hosting provider | Hosting | Web traffic and short-lived request logs |
| Email delivery provider | Emailing leads to the dealership | Contact details a visitor gave, and the vehicle |
| Payment processor | Dealership billing | Dealership billing contacts and payment details |
| Web-crawling service | Reading some dealer websites | Public website pages only |
A current list of our service providers by name is available to dealerships on request.
In Chrome and Edge, speech-to-text uses the browser's own speech recognition, provided by Google or Microsoft under the browser's terms. Our AI and speech-to-text providers process conversation data under business terms that don't let them train their models on it.
Retention and deletion
- When a dealership's agreement ends, we delete all of its data within 30 days: transcripts, leads, logs, inventory, search index, video-provider conversations and dashboard accounts. A dealership can ask for this at any time.
- A single visitor's leads and conversations can be deleted on request, through the dealership or by emailing us.
- We run both through a documented deletion procedure. Deleted data can remain in encrypted database backups until they expire in the normal backup cycle.
- We may keep aggregated statistics and de-identified examples to improve Lot Greeter. They contain nothing that identifies a visitor or the dealership, and we don't try to re-identify them.
Incidents
If we confirm a security incident affecting a dealership's data, we'll notify that dealership without undue delay, and within 72 hours. Report a vulnerability to brennen@lotgreeter.com.
Compliance status
We've maintained a documented security control environment since July 2026 and are working toward a SOC 2 Type II audit. We don't have a SOC 2 report yet, and we'll say so plainly on any questionnaire.
See also our Privacy Policy and Terms of Service.