Automotive Dealer MFP Security — FTC Safeguards Rule Compliance

The Short Version

Auto dealerships are categorized as “financial institutions” under the Gramm-Leach-Bliley Act and are bound by the FTC Safeguards Rule as amended in December 2022 and enforced in June 2023. The amended rule requires encryption of customer information in transit and at rest, multi-factor authentication for access to customer data, documented access controls, and — since May 2024 — a 30-day breach-notification trigger for incidents involving 500 or more consumers. Default scan-to-email from a dealership MFP satisfies none of those requirements. The document moves over SMTP without enforced encryption, lands in mailboxes that typically don’t enforce MFA consistently, and produces no cryptographic record of access.

SecureMFP replaces the workflow entirely. The deal jacket, credit app, or insurance card is encrypted at the MFP, transmitted as an encrypted payload, and retrieved by the authenticated recipient via a secure link — never an attachment. There are no plaintext copies in inboxes, no attachments sitting in archives indefinitely, and the audit trail is captured at the transport layer. For dealerships already using Botdoc Connect for customer-facing document exchange, SecureMFP closes the last unsecure path in the document lifecycle: the scanner itself.

What the Full Automotive Playbook Will Cover

The full Automotive playbook (in production) will cover:

• The 2023 amended FTC Safeguards Rule — the eight required elements, the 30-day notification trigger, and what dealerships are actually getting cited for
• Deal jacket workflow — sales, F&I, accounting, and title clerks handoffs without email attachments
• Credit applications and adverse-action notices — NPI transmission requirements under FCRA and Safeguards
• Driver’s license and insurance card handling — state-by-state retention and access obligations
• Red Flags Rule alignment for identity-theft prevention programs
• The OFAC / Form 8300 cash reporting workflow — when scanned documents must stay under verified chain-of-custody
• Integration with DMS systems (CDK, Reynolds & Reynolds, Dealertrack) and how SecureMFP fits alongside Botdoc Connect
• Deployment patterns for single-store dealerships, auto groups, and BDC-driven operations

Read Now: Zero-Trust Document Transport

While the full playbook is in production, this briefing covers why the legacy trust model behind scan-to-email fails under FTC Safeguards scrutiny — and what zero-trust document transport looks like at a busy dealership.

Briefing · Zero-Trust

Why Zero-Trust Document Transport Matters for MFPs →

Legacy MFP trust models assume the network is safe. Zero-trust doesn’t. How that reshapes scan-to-delivery architecture in a Safeguards-regulated environment.

Adjacent Reading

Briefing · Regulated Scan Workflows

The Scan-to-Email Time Bomb (the pattern repeats)

Written about K-12, but the failure mode is identical at a dealership: default SMTP paths, plaintext copies, discoverable mailboxes, uncontrolled retention. The regulation changes; the gap doesn’t.