Security at Top Tier Plan
Your dealership trusts us with employee records, training results, and day-to-day operating data. Here is how we protect it, written to support your vendor review under the FTC Safeguards Rule.
Last updated: October 4, 2026
HTTPS only (TLS 1.2+)
Two-step sign-in for managers
Separate database per dealership
Sign-in activity log
Nightly backups, copied off-site
Cyber liability insurance
Your data stays separate
- Every dealership has its own database and its own site address. Users of one dealership cannot see another's data.
- Your administrators decide who has an account, what role they have, and which positions (and therefore which tools) they can use.
- People who sign themselves up can't get in until a manager approves them.
Encryption
- All traffic uses HTTPS with TLS 1.2 or 1.3. Older, weaker versions are refused, plain HTTP is redirected, and browsers are told to always use HTTPS (HSTS).
- Passwords are stored only as bcrypt hashes, never in readable form. Sign-in codes and "remember this device" tokens are stored hashed, too.
- Backups are copied off-site over an encrypted connection.
Sign-in protection
- Two-step sign-in: administrators and managers enter a one-time code emailed to them after their password. Codes expire in 15 minutes and allow 5 tries.
- Strong passwords: at least 12 characters, with common and easy-to-guess passwords blocked.
- New employees get a random temporary password and must choose their own at first sign-in.
- The website signs people out after 30 minutes of inactivity. Changing or resetting a password signs out other devices.
Visibility and accountability
- Your administrators can review a Sign-in Activity log: successful and failed sign-ins, wrong codes, password changes and resets, accounts added, approved or removed, and role changes, with time, IP address and device. Kept for one year.
- When Top Tier Plan support needs to help inside your site, access uses a one-time, single-site pass, lasts at most one hour, and is recorded in your activity log.
Hosting and backups
- Hosted in the United States with a commercial hosting provider that manages the servers, network protection, and software updates.
- Every database is backed up nightly and kept for 30 days. Site files and uploads are backed up weekly. Copies are sent to a separate, off-site location every day, in addition to our hosting provider's own backups.
- Our system only accepts requests from Top Tier Plan's own web pages.
Privacy and data ownership
- Your dealership owns its data. We use it only to provide the service. We never sell it and use no advertising or analytics trackers.
- Messages are deleted after 3 months and warranty uploads after 60 days.
- When a subscription ends, your data is available for export for 30 days, then deleted from active systems and from backups within 90 days.
- Details are in our Privacy Policy.
If something goes wrong
- We follow a written incident response plan.
- If we confirm a security incident affecting your dealership's data, we notify your designated contact within 72 hours and work with you on next steps and any notices you need to send.
- We carry cyber liability insurance; a certificate is available on request.
For your vendor review
- Built to support your obligations under the FTC Safeguards Rule (GLBA) and state privacy laws.
- Available on request: a signed Data Processing Agreement, our Written Information Security Program (under NDA), our insurance certificate, and answers to your security questionnaire.
Questions, documents, or reporting a security concern
Email support@toptierplan.com with "Security" in the subject. If you believe you've found a vulnerability or that an account has been misused, please tell us right away; we respond to security reports within one business day.
This page describes our current practices and may change as we improve them. It is not a contract; your subscription agreement and Data Processing Agreement govern our legal relationship.