Trust center
The frameworks Dealer Suite 360 is built around.
Security, privacy, AI governance and accessibility aren’t add-ons. These are the recognized frameworks we design and operate the platform against — and exactly how we apply each one.
Dealer Suite 360 is designed and operated in alignment with these frameworks. Alignment does not imply formal certification.
Security
SOC 2 — Trust Services Criteria
SOC 2 is a reporting framework from the American Institute of CPAs (AICPA). It evaluates a service provider’s controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A SOC 2 report is issued by an independent CPA firm after an examination.
How we apply it
ISO/IEC 27001 — Information security management
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to identify information risks and treat them with controls. Its Annex A lists controls across organizational, people, physical and technological themes. Certification is granted by accredited certification bodies after an audit.
How we apply it
NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework (CSF) 2.0, published by the U.S. National Institute of Standards and Technology in 2024, organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary and used by organizations of every size.
How we apply it
OWASP Application Security Verification Standard
The OWASP ASVS is an open standard from the OWASP Foundation that lists the security requirements a web application should meet — authentication, session management, access control, input handling, cryptography, logging and more — across three levels of assurance.
How we apply itPrivacy
ISO/IEC 27701 — Privacy information management
ISO/IEC 27701 defines a privacy information management system (PIMS). It sets out how organizations acting as controllers or processors of personal information should govern, protect and account for that information, and maps to privacy laws around the world.
How we apply it
PIPEDA — Canadian privacy law
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal privacy law for private-sector organizations. It is built on ten fair information principles, including accountability, consent, limiting collection and use, safeguards, openness and individual access.
How we apply it
Québec Law 25 — Private-sector privacy
Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) updated Québec’s private-sector privacy law in phases from 2022 to 2024. It requires a person in charge of protecting personal information, privacy impact assessments, confidentiality incident reporting to the Commission d’accès à l’information, clear consent and transparency, and data portability.
How we apply itResponsible AI
ISO/IEC 42001 — AI management system
ISO/IEC 42001 is the first international standard for an artificial intelligence management system (AIMS). It helps organizations that build or use AI manage its risks and opportunities responsibly — covering accountability, transparency, data quality and human oversight.
How we apply it
NIST AI Risk Management Framework
The NIST AI Risk Management Framework (AI RMF 1.0) helps organizations design, develop and use AI in ways that are trustworthy. It is built around four functions — Govern, Map, Measure and Manage — and characteristics such as validity, safety, security, transparency, privacy and fairness.
How we apply it
Security or privacy questions?