Security
Last updated: November 5, 2026
Dealerships trust us with their customers’ names, phone numbers and addresses. This is how we look after them.
Each dealership’s data stays its own
- Every ride, customer and message belongs to one dealership. The server checks the dealership on every request, and the database refuses reads that don’t match.
- People see only what their role needs. Drivers see their own rides; advisors see their own customers unless an admin allows more; internal notes are for staff only.
- OTL staff reach a dealership’s data only when an owner has given them access to it.
Signing in
- Every page and app connection uses encrypted HTTPS.
- Passwords are stored as one-way hashes, never as plain text. Repeated sign-in attempts are slowed down.
- Turning off a person’s access takes effect straight away, on the website and in the phone app.
Customers’ information
- A driver’s location is shared only during a ride, not all shift.
- Tracking links stop working 24 hours after the driver sets off. Intake links work once and expire after 3 hours.
- A customer who replies STOP gets no more texts, from any dealership.
- Replies to our texts are accepted only when they carry our text provider’s signature.
- Card payments are handled by Stripe. Card numbers never reach our servers.
Report a security problem
If you think you’ve found a weakness, email support@outthelot.com with the details and how to see it. Please don’t look at or change other people’s data while testing, and give us a reasonable time to fix it before telling anyone else. We’ll reply and keep you updated.
More about what we collect and why is in the Privacy Policy.