Your shop's data stays yours.
Your customers, jobs and numbers are kept separate from every other shop and seen only by the people you invite. Staff can protect their sign-in with an authenticator app. Your jobs and invoices stay in Shopmonkey the whole time.
Your shop only
Kept separate
No other shop can see your data
Sign-in
Two-step sign-in
Available with an authenticator app
Connections
Stored encrypted
Shopmonkey and other logins
Activity
On the record
Who did what, and when
How we protect you
Protected the way a shop owner would expect.
The short version, in plain English. The technical detail is further down for your IT contact.
Your data is kept separate
Every shop's customers, jobs and numbers are walled off. Nobody from another shop can see them, even by accident.
Two-step sign-in
Staff can turn on a second sign-in step from an authenticator app, and old sessions end when a password or role changes.
Your logins stay private
Your Shopmonkey, Google and other connection details are stored encrypted and are never shown in the app.
Every action on the record
Changes your team makes are logged with who, what and when, so owners can always check.
Backed up
Your shop's data is backed up and encrypted, and every backup is recorded.
AI drafts, people decide
AI drafts a reply when someone asks. A person on your team reads it and sends it. Automatic texts run only after an owner switches them on.
Your team
Everyone sees what their job needs, and no more.
You decide who gets access and what they can do. Remove someone and their access ends right away.
Owners
See everything, including money, reports, settings and who has access.
Advisors
Work customers, texts, bookings and follow-ups from the screens their job needs.
Read-only staff
Look things up without changing anything.
AI and texting
AI helps. Your team stays in charge. AI drafts. People send.
VehicleDesk uses AI to draft replies, and only texts customers who agreed to hear from you.
Drafts and suggestions
AI gets only what it needs to write a helpful draft. Text inbox drafts only use the price already on file and never promise a discount. Drafting a reply sends the recent conversation to the AI provider.
- Reply drafts for texts and reviews
- Drafts only, never sent on its own
Every customer message
A person reviews and sends every one-off message, and automations only run after an owner switches them on.
- Texts only to customers who agreed
- STOP replies honoured right away
- Campaigns need owner approval
Technical detail
For your IT contact.
Each row is a control in place today. Ask us for the current security summary during your demo.
Show the technical controls
| Control | Mechanism | What it protects |
|---|---|---|
| Tenant isolation | Authenticated work runs as a shop-scoped principal. Object lookups include both identity and shop ID. | Shop data, credentials, and audit history stay inside the tenant that owns them. |
| Role capabilities | Owner, Admin Advisor, and read-only map to named capability families. Method-aware gates separate read from manage. | Protected data stays out of values, counts, and errors for anyone without the capability. |
| Sessions | Random session secrets are stored only as SHA-256 hashes. Idle expiry, absolute expiry, privilege-version checks, and staff-visible revocation apply. | A password, privilege, or membership change invalidates every open session for that account. |
| MFA | Authenticator apps and recovery codes. Enrolled members complete an MFA challenge at sign-in. Workspace administrators see per-member enrollment. | Security-sensitive actions require authenticator assurance in the current session. |
| Provider credentials | Integration secrets are encrypted with AES-256-GCM under a tenant-bound context before storage. Rotation is shop-scoped and records conflicts instead of overwriting. | Secrets stay server-side. They never reach the browser. |
| Rate limiting | Public, staff, admin, messaging, and finance routes use Postgres-backed limiters. Login and MFA have dedicated IP and challenge limits. AI requests have per-user, per-shop, and global budgets. | A limited request returns an explicit rate-limit state and writes a security event. |
| Edge and browser policy | The public site and the app publish content-security, frame-denial, and referrer policies. API mutations check origin, Fetch Metadata, and CSRF. | Cross-site requests and embedded framing are stopped before they reach shop data. |
| Audit logging | The shop audit log records named staff writes, support-console views, and portal issuance. Incident-control and provider events write to an allowlisted security-event catalogue with integrity metadata. | Every named action carries who, what, and when for the shop that owns it. |
| Backups | Backup runs write encrypted, immutable evidence records. | Every backup run is recorded and verifiable. |
| Incident containment | Preapproved switches block messaging, AI, sync, webhooks, exports, support access, public booking, and portal issuance on demand. | A blocked operation returns an explicit unavailable state and records a security event. Shop data stays as it was. |
Vulnerability disclosure
A clear path for good-faith security research.
Report VehicleDesk-owned surfaces using accounts and data you are authorized to use. Stop after demonstrating the issue and report it promptly.
In scope
VehicleDesk-owned product surfaces
Public VehicleDesk properties and the authenticated CRM and API, using only your own authorized account and data.
- Tenant isolation and authorization defects
- Authentication, export, portal, and booking issues
- Webhook, integration, messaging, and AI-boundary defects
Out of scope
Third-party and disruptive testing
Shopmonkey, Google, OpenAI, Twilio, Resend, GitHub, our hosting and network providers' own platforms, customer sites, and other third parties are out of scope.
- Denial of service, credential stuffing, or high-volume scanning
- Social engineering, spam, or persistence
- Destructive changes or data exfiltration
Good-faith safe harbor
Research must stay bounded and confidential.
Good-faith research that stays in scope, uses authorized accounts and data, avoids harm, stops after demonstrating the issue, and is reported promptly is treated as authorized under the draft policy. It does not authorize unlawful activity or third-party testing, and the legal language still requires counsel review.
- Use only accounts and data you own or are authorized to test
- Stop after demonstrating the issue and report it promptly
- Do not test third-party systems or cause customer harm
Response targets
Operating targets, not a bounty or deadline.
Acknowledgement within three staffed business days, initial triage within seven, and an update at least every 14 staffed business days for accepted reports. These are not guarantees, a bounty, or a remediation deadline.
- Acknowledgement within three staffed business days
- Initial triage within seven staffed business days
- Updates at least every 14 staffed business days while open
How to report
Send a short, non-sensitive email.
Email security@vehicledesk.io with the affected surface, the impact, minimal steps using your own data, and UTC times. Leave credentials, active secrets, customer data, exploit archives, and provider payloads out of the email.
Questions about your shop's data?
Bring your questions. We'll walk through sign-in, access and your data on the live product and share our security summary.
Prefer to talk? Call 201-650-7371.