Safeguards-ready today. Audit-ready path documented.

Compliance matrix.

FTC Safeguards — All 9 Elements

16 CFR Part 314 requires all nine elements of an Information Security Program. Louie has every one built in.

Threat model (STRIDE summary).

Data handling.

Data classes

• Dealer identifiers — rooftop name, DMS integration tokens. Encrypted at rest.
• Customer PII — name, phone, email, DOB for deal structure. Encrypted in transit (TLS 1.3); sensitive fields and exports encrypted (AES-256-GCM); redacted before LLM calls.
• Financial data — credit score tier, income range, deal structure. Never transmitted to third-party LLMs as raw values; bucketed before send.
• Operational telemetry — request latencies, error rates, module usage. No PII.

Retention & deletion

• Dealer-initiated deletion: honored within 5 business days.
• Customer deletion request: honored within 30 days (CCPA / CPRA aligned).
• Broker access logs: 24-month retention under NDA, then purge.

Cross-border transfer

• All data resides on US-region infrastructure.
• LLM inference: provider routing allows selecting US-region endpoints (Anthropic, Azure, GCP).
• Local Ollama inference available for dealers who require on-prem processing.

Incident response.

Detailed runbook, contact tree, and post-mortem template are in the data room. Report vulnerabilities to brian@louieauto.com — PGP key published in /.well-known/security.txt.

Dependency & supply chain.

• SBOM generated per release (CycloneDX format).
• Dependencies pinned; npm audit + Snyk CI integration on readiness path.
• No known high-severity unpatched CVEs at date of publication.
• LLM provider routing isolates single-vendor failure — Anthropic, OpenAI, Azure, GCP, local Ollama all supported.

This page is a public summary. The full security pack (control matrix, gap analysis, penetration-test scope, SOC 2 readiness roadmap) is available under NDA.

Uptime SLA.

Full SLA terms at louieauto.com/sla. Enterprise and Managed Services tier accounts receive SLA credits and dedicated escalation contacts. Group and Enterprise tier: 12-month minimum with formal SLA addendum.

Penetration testing & vulnerability disclosure.

Pen test cadence

• Annual penetration test scheduled. Scope: API surface (/api/*), authentication flows, session management, data access controls, injection vectors.
• Testing methodology: OWASP Testing Guide v4 + ASVS Level 2 controls.
• Reports and executive summary available under NDA to qualified acquirers and enterprise partners.

Vulnerability disclosure

• Responsible disclosure: report to brian@louieauto.com with subject line SECURITY:. PGP key at /.well-known/security.txt.
• Acknowledgement within 24 hours. Severity assessment and remediation timeline within 5 business days.
• Coordinated disclosure window: 90 days from report unless extended by mutual agreement.
• No bounty program active at this time. Researchers acknowledged in release notes.

Enterprise support tiers.

All license holders receive dedicated support. Managed services partners (Presidio-model) receive joint escalation access for their client rooftops.

For enterprise procurement: send security questionnaires and vendor assessment forms to brian@louieauto.com. Full responses within 5 business days. NDA available on request before data room access.

System requirements.

LouieAuto ships two ways: a downloadable desktop app (Windows or Mac) for single rooftops — with the AI brain running on-device — and a local-server deployment for multi-rooftop groups (staff use a browser, no per-device install). The requirements below are for the group server host and client browsers.

Server (on-premise host)

Client browsers (all staff devices)

Bandwidth

• Standard operations: 1–5 Mbps per active user (dashboards, deal entry)
• AI features (briefings, deal coach, voice): 5–10 Mbps per concurrent AI session
• DMS sync (nightly batch): burst up to 25 Mbps for 2–5 minutes
• Multi-rooftop groups: recommend dedicated LAN segment for server; standard business internet (50 Mbps+) for user devices

Backup & restore

• Automated daily backup: runs at 2 AM local; average completion 3–8 minutes depending on database size
• Restore from backup: average 12–25 minutes for a single-rooftop database; up to 45 minutes for a multi-store group database
• Optional cloud sync: encrypted offsite backup to dealer's cloud provider (AWS S3, Azure Blob, or Google Cloud Storage) configurable in admin settings
• Point-in-time recovery: available to the last automated backup (24-hour max data loss window without continuous WAL archiving)

The on-device AI brain (local Ollama inference) runs offline after initial setup — deal entry, inventory, compliance, pipeline, lender routing, and the nightly learning loop all function without internet. Optional cloud-LLM features (e.g., long-form Ad Generator, conversational chat) use an internet connection to your configured provider. Fully air-gapped operation is supported — setup guide at louieauto.com/developers.