Security & data posture

Your books are the most sensitive data you own.

So we built for that from the first line of code — not as a policy you have to take on faith. Your compliance records, distributor credentials, and customer data stay encrypted, isolated, and deletable on your command.

AES-256-GCM at restTLS in transitPer-dealer isolationMFA + session kill-switch
Trust by architecture

Six commitments, enforced in code

Not promises in a policy doc — guarantees the system makes for you on every request.

Encrypted, end to end

Distributor credentials, API tokens, and secrets are encrypted at rest with AES-256-GCM. Everything moves over TLS in transit, on certificates that auto-renew. Nothing sensitive is ever stored in the clear.

AES-256-GCM · TLS

Isolated to you

Every query is scoped to your dealership at the data layer — enforced automatically in code, not by a checkbox someone can forget. No other dealer's account can reach your records, by design.

tenant-scoped

Credentials never travel

Your distributor logins are stored encrypted and stay private to your account. They're never shared with other dealers and never leave your tenant — the network effect comes from shared learning, never shared secrets.

private

Human approval, always

Nothing writes to your bound book without you reviewing every field first. Serial numbers are duplicate-checked against Fastbound, every decision is logged, and there is no auto-commit path — at any confidence score.

no auto-commit

Delete everything in one click

One MFA-protected action wipes all of your data. Your tenant can be backed up and restored, and there's no rip-and-replace lock-in — keep your current systems and leave whenever you want.

one-click · MFA

Honest about scope

We're not a compliance platform and we don't pretend to be. FFL Overwatch makes the work faster; your bound book stays your system of record and your licensed judgment stays yours.

not a system of record
Your data is yours

No lock-in. No hostage data. No surprises.

FFL Overwatch is a layer on top of the systems you already run — not a replacement that traps your records. You can connect what you want, export what you need, and walk away clean.

  • One-click deletionAn MFA-protected action erases all of your data, on your schedule — not after a support ticket and a 30-day wait.
  • Keep your systemsFastbound, your POS, your bank, your distributors — all stay in place. No rip-and-replace migration.
  • Backup & restoreYour tenant can be snapshotted and restored, so an accident is recoverable instead of catastrophic.
  • We don't train on youYour records aren't pooled into a shared model. The network effect is shared UPC learning — never your data.
Under the hood

For the technically minded

The specifics, in plain terms — because trust should be inspectable, not assumed.

Authentication
Short-lived JWT access tokens with rotating refresh tokens, role-based access (owner / admin / user), TOTP multi-factor authentication, and a server-side session kill-switch that can revoke access instantly.
Banking
Bank connections run through Plaid in read-only mode. Account credentials are tokenized by Plaid — FFL Overwatch never sees or stores your online-banking username or password.
Bound book
Acquisitions are staged for review and only committed to Fastbound after you approve every field. Duplicate serials are checked first, the FFL contact is snapshotted at receipt, and a full audit trail records who approved what and when.
Marketing guardrails
The email engine enforces manufacturer MAP pricing and blocks below-cost pushes behind an explicit acknowledgement — so an automated blast can't quietly violate a pricing agreement or sell at a loss.

Have a security question we didn’t answer, or need details for a vendor review? Talk to us — a real person who built it will answer.

See what your current stack can’t show you.

Take the 90-second tour on a sample dealership — or start your 30-day free trial and connect your own.

Plans from $149/mo · 30 days free · Cancel anytime · Keep your current systems · Encrypted, isolated, and deletable in one click