AutoAttach Data Security Exhibit
Effective: August 13, 2026. FTC Safeguards Rule service provider commitments.
This Data Security Exhibit ("Exhibit") is incorporated into the Subscription Agreement between Auto Attach LLC ("AutoAttach") and Customer. Customer, as an automobile dealer, may be a "financial institution" subject to the FTC Safeguards Rule, 16 C.F.R. Part 314. This Exhibit sets out the safeguards AutoAttach maintains as Customer's service provider and is intended to support Customer's obligations under 16 C.F.R. 314.4(f) to select service providers capable of maintaining appropriate safeguards and to require those safeguards by contract.
1. Scope of Customer Information
In providing the service, AutoAttach processes the following categories of consumer information on Customer's behalf: consumer name and contact information, vehicle and deal identifiers, and accessory presentation records including selections and declinations ("Customer Information"). The service is not designed to collect, and Customer shall not enter, Social Security numbers, driver's license numbers, credit application data, or payment card numbers of consumers.
2. Safeguards
2.1 Encryption. Customer Information is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent.
2.2 Access controls. Access to production systems is limited to personnel with a need to know, protected by multi-factor authentication, and governed by role-based access controls under the principle of least privilege. Access is revoked promptly on role change or separation.
2.3 Monitoring and logging. AutoAttach maintains logging of access to production systems and monitors for anomalous activity.
2.4 Vulnerability management. AutoAttach applies security patches to systems under its control on a risk-prioritized basis and periodically assesses its systems for vulnerabilities.
2.5 Secure development. Changes to the service are made through a controlled development and deployment process with separation between development and production environments.
2.6 Personnel. Personnel with access to Customer Information receive security awareness training and are bound by confidentiality obligations.
2.7 Subcontractors. AutoAttach uses vetted infrastructure subcontractors to host and process Customer Information within the United States and requires safeguards from those subcontractors consistent with this Exhibit. A current list of subprocessors is published at autoattach.com/legal/subprocessors.
2.8 Data segregation. Customer Information is logically segregated by rooftop tenant.
3. Incident Notification
AutoAttach will notify Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a security event resulting in unauthorized access to unencrypted Customer Information. The notice will describe the nature of the event, the categories of information involved, and remediation steps taken or planned. AutoAttach will reasonably cooperate with Customer's own notification obligations, including any notice Customer is required to give under 16 C.F.R. 314.4(j).
4. Assessments
No more than once per year, and additionally following a confirmed security event, AutoAttach will complete Customer's reasonable written security questionnaire or provide a summary of its safeguards program sufficient for Customer to periodically assess AutoAttach as required by 16 C.F.R. 314.4(f)(3).
5. Retention, Return, and Disposal
On termination or expiration of the Subscription Agreement, AutoAttach will make Customer Information available for export for thirty (30) days, then securely delete Customer Information from production systems within sixty (60) days, except as retained in routine backups (which expire on their normal cycle) or as required by law. On written request, AutoAttach will certify deletion.
6. Contact and Review
AutoAttach designates a security contact reachable at security@autoattach.com. AutoAttach reviews and updates its safeguards program at least annually and as risks change. Nothing in this Exhibit makes AutoAttach a "financial institution" under the Safeguards Rule or transfers Customer's compliance obligations to AutoAttach.
Auto Attach LLC | autoattach.com | Sarasota County, Florida