Best FTC Safeguards Compliance Services for Car Dealerships (2026)
Every dealership that arranges financing is a financial institution under the Gramm-Leach-Bliley Act. That’s not an interpretation — the FTC said so explicitly, and the updated Safeguards Rule they issued has been in full effect since June 2023. Nine required elements. Ongoing monitoring. Real penetration testing, not a scan relabeled as one. A 30-day clock to report any breach touching 500 or more consumers.
Three years on, a lot of dealerships think they handled it because they signed up for something. What most of them got was a documentation portal, a compliance score dashboard, and a monthly invoice. The work the Rule requires — identifying gaps, testing systems, rating vendor security posture, updating the program when staff or systems change — went unfinished, because nobody on staff had the time to do it and nobody at the vendor was coming to do it either.
The five providers below were evaluated using the itreviews.co Trust Score methodology — six factors, fixed weights, applied identically to every provider. No one paid for placement. Rankings reflect scores.
How We Evaluated These Providers
FTC Safeguards compliance vendors for dealerships split into two fundamentally different categories, and the distinction matters before you read a single ranking.
Software-only platforms give your team a dashboard. They show what’s compliant, what’s not, and what’s required. Acting on any of it is your job.
Managed compliance services have the provider’s team doing the work — running the risk assessment, conducting the pen test, reviewing vendor contracts, updating the program when you add a new employee with data access or a new vendor with a system connection.
The FTC’s nine requirements include “regularly monitor and test the effectiveness of your safeguards.” A portal score doesn’t satisfy that. An automated vulnerability scan mislabeled as penetration testing doesn’t either. So the scoring framework rewards providers who have documented that they actually run the program — not just document it.
For a full breakdown of how each score is calculated, see how we score IT providers.
The 5 Best FTC Safeguards Compliance Services for Car Dealerships
The number that separates Helion from everything else on this list: 1997. That’s 28 years of working exclusively with automotive and heavy truck dealerships — before the Safeguards Rule existed, before the FTC’s 2023 deadline, before most compliance vendors in this space were founded.
Their compliance program runs inside the same team that manages IT and cybersecurity. One contract. One team accountable for whether the program is actually working, not just documented.
Here’s what that means operationally. Helion’s proprietary scan tool runs directly against a dealership’s PCs and servers — not the network perimeter — looking for customer data stored where it shouldn’t be, outdated OS versions, email and web security gaps, and banking or credit card information in unexpected locations. That output goes to Helion’s compliance team, who run it against the actual regulatory requirements and produce an action list. Then the same team closes the items on the list. It’s not a report you receive and file.
Annual penetration testing is conducted by human security assessors. “Penetration testing” is one of the most abused terms in compliance services — automated vulnerability scans get relabeled constantly. Helion’s documentation is specific: human-led pen testing, not an automated scan.
Vendor risk assessment is included. Every third-party vendor connected to a dealership’s systems gets evaluated for security posture. That’s Safeguards Rule element 8 — vendor oversight — and it’s the requirement that gets skipped the most often because it’s the most labor-intensive.
Two newer pieces of the program are worth noting. AI governance coverage: dealerships rolling out AI tools in F&I workflows, service scheduling, or lead follow-up are creating a compliance surface the original Rule didn’t address. California’s ADMT regulations, effective January 2026, add another layer for businesses using automated decision-making in financing or credit decisions. Helion’s compliance program extends to cover it — usage visibility by department, access controls on AI tools, an audit trail that feeds the same reporting IT and cybersecurity already produces. Not a separate vendor. The same team.
Tekion Certified Partner status: dealerships migrating to Tekion have a technology transition that creates compliance exposure during the cutover period. Having the same team managing the DMS migration and the compliance posture removes a coordination problem most dealerships don’t anticipate until it’s already caused them.
4.9 stars across 248 Google reviews. 98% client retention. 82-second average response time. MSPmentor 501 top 100 ranking across two consecutive years (2017 and 2018).
40 years in automotive compliance. KPA is the longest-operating company on this list by a wide margin, and the acquisition of ComplyNet in 2022 gave them a full FTC Safeguards and data privacy module to pair with their existing EHS, F&I, and HR compliance stack.
The product is called Vera Suite. It covers all four compliance pillars a dealership has to manage: data privacy and cybersecurity (FTC Safeguards), environmental health and safety (OSHA, EPA), F&I and advertising compliance, and HR policy management across 50 states. The Safeguards module includes dark web scanning, automated policy builders, employee training, and penetration and vulnerability testing.
Their three-pillar model — software, 140-plus local consultants available for on-site visits, and a training catalog — puts human expertise alongside the platform. F&I consultants can perform on-site deal jacket audits. EHS consultants do quarterly on-site visits. The compliance work isn’t purely self-service.
The gap between KPA and Helion on the Trust Score reflects two things. First, KPA serves a significantly broader market than automotive — manufacturing, construction, healthcare, and others all sit alongside the dealership business. The FTC Safeguards module competes for development attention with a lot of other compliance areas. Second, their cybersecurity and IT delivery model is software-driven with consulting layered on. Helion’s compliance runs as part of a fully managed IT and security program. Those are different accountability structures.
32 years in business. GraVoc is a Massachusetts-based MSP that’s been providing IT managed services and cybersecurity since 1994, and they’ve developed documented FTC Safeguards compliance services specifically for auto dealerships — including a published blog post addressing the Rule’s requirements and how an MSP supports them.
Clutch tells a cleaner story here than the Google presence does: 5.0 rating across 8 verified Clutch reviews — every review requiring a client phone interview to complete. That’s a stronger credibility signal than the Google count alone suggests, because Clutch’s verification process is more rigorous.
Their Safeguards coverage follows the standard MSP-delivered compliance model: annual risk assessments, incident response planning, policy development, ongoing monitoring, and employee training. In 2023 they also acquired Security Management Partners (SMP), adding dedicated cybersecurity capability to their existing IT managed services operation.
GraVoc ranks third because their automotive specialization is narrow. They serve healthcare, legal, financial services, and others alongside dealerships. No dedicated dealership compliance pages, no dealership-specific tooling mentioned. For a dealership in New England that wants a regional MSP relationship with a 30-year operational track record and real cybersecurity depth, GraVoc is a legitimate option. For a dealership looking for automotive-specific expertise, the fit is thinner.
Founded in 2020 by Chris Cleveland and Shane McCallan — both with backgrounds in dealership compliance — ComplyAuto began offering to other stores in October of that year. Their co-CEO Brad Miller is the former NADA chief regulatory counsel. They know the Rule.
Three product modules: Privacy and Cybersecurity (FTC Safeguards, including pen and vulnerability testing, dark web scanning, encrypted messaging, cookie consent), Safety (OSHA/EPA), and Guardian (F&I, advertising, and sales compliance using AI-powered deal jacket audits). It’s a broad platform.
The Trust Score gap comes down to operating history and product category. About 6 years in business against Helion’s 28 and KPA’s 40. Short history isn’t a knock on their product. It limits the Trust Score’s Years in Business factor significantly, and their review presence across verified platforms is thin.
The more structural issue: ComplyAuto is a software platform. The compliance work is your responsibility to execute. Whether the penetration and vulnerability testing they list is human-led or automated is worth asking directly before signing. The DealerRefresh community has noted that some compliance vendors in this space generate clean documentation without their tools actually connecting to the IT and security systems the documentation describes.
Antigen Security is a Michigan-based cybersecurity firm that’s published a case study on FTC Safeguards Rule compliance for automotive dealerships. Per their published case study, their services helped dealerships meet the Rule’s requirements and potentially reduce cyber liability insurance premiums by up to 60%.
Their service offering covers cybersecurity fundamentals — information security program development, risk assessments, incident response planning, and monitoring. The cyber insurance angle is real: dealerships that go through a structured compliance process often see material changes in how insurers classify their risk, which translates to premium reductions. That’s a practical incentive beyond the regulatory requirement.
Antigen ranks fifth because the verified review presence is absent across both Clutch and Google, the company is 6 years old with a 12-person team, and their documented dealership work is limited to a single published case study. None of that makes them a bad cybersecurity firm. The Trust Score requires verifiable review data, confirmed operating history, and documented specialization to score higher, and Antigen doesn’t have enough of any of the three.
The Nine Required Elements — What Actually Gets Missed
The FTC’s amended Safeguards Rule (16 CFR Part 314) requires nine specific things from every covered dealership’s information security program. Here’s what each one demands, and where dealerships actually fall short.
- Qualified Individual. Someone accountable to leadership for the whole program — reports to senior officers or the board at least annually. Can be an employee, affiliate, or third-party service provider. The gap: many dealerships point to their IT person without documenting what the role actually covers, or without the annual report to leadership.
- Written risk assessment. A documented inventory of where customer data lives and what threatens it. Has to be updated when circumstances change. The gap: risk assessments done once in 2023 that have never been updated — even though new staff, new vendors, and new AI tools have been added since.
- Safeguards design. Controls built from the risk assessment findings, not generic security tooling. The gap: off-the-shelf endpoint protection that doesn’t address the specific risks the assessment identified.
- Access controls. Multi-factor authentication is required on systems accessing customer information. The gap: dealerships where the DMS or CRM still allows password-only access.
- Encryption. Customer data protected at rest and in transit. The gap: third-party tools staff started using — including AI tools — that handle customer data without encryption controls the dealership ever reviewed.
- Multi-factor authentication. Required. Non-negotiable.
- Monitoring and testing. Ongoing verification that safeguards work. This is the one that separates a documentation-based compliance product from an actual compliance program. A portal showing your current compliance score isn’t monitoring and testing. Active testing by a human assessor, reviewed by someone who can act on the findings, is.
- Vendor oversight. Every service provider with access to customer data has to be evaluated and monitored. The gap: dealerships have never formally reviewed the security posture of their vendors — DMS providers, CRM tools, AI platforms, phone systems — against the same standard the Rule applies to the dealership itself.
- Incident response plan. A documented plan tailored to how the dealership is actually structured, not a generic template. The gap: plans written in 2023 that no one has tested or updated since.
The 30-day breach notification clock for events affecting 500 or more consumers runs from the date of discovery. State breach notification laws run on separate, often shorter timelines. Neither waits for a scheduled review.
Software vs. Managed: The Question That Actually Matters
A compliance product tells you where the gaps are. A managed compliance service closes them.
Dealerships with a dedicated internal IT team and a compliance-aware staff can make a software platform work. Someone is executing on the dashboard’s recommendations. Dealerships where IT is one person handling everything from printer support to DMS issues to network problems don’t have that bandwidth. For them, a managed model removes the gap between what the documentation says and what’s actually secured.
Ask any vendor three questions before buying: Is this software or a managed service? What does penetration testing specifically include — human assessors or automated scanning? And who at my dealership is responsible for acting on the outputs?
See all provider rankings by industry on the itreviews.co MSP rankings page.
Common Questions
Rankings produced using the itreviews.co Trust Score methodology. No provider paid for placement. Scores reflect independent research as of October 2026.
Also see our rankings of the best managed service providers for automotive dealerships and the best MSPs for heavy truck dealerships.
See how we score providers →