Six frameworks. Handled in the software.

What it requires

Dealers are financial institutions under the rule. You need a written security program with access controls, encryption of customer information at rest and in transit, multi-factor authentication for anyone accessing customer data, monitoring, and a way to detect unauthorised access.

What Quikdealer does

• Role-based access control with 160+ discrete permissions, so staff see only what their job needs
• Column-level encryption for driver's licence numbers and integration secrets, keyed per dealership
• Two-factor authentication available to every user, with an organisation-wide requirement switch
• Every access to sensitive data written to an append-only, hash-chained log
• Tenant isolation enforced by per-command database policies, not application code

What you can show

An access-control export showing who holds which permission, and an audit export showing every touch of customer financial data with timestamp, actor, and IP.

What it requires

You must have a written identity-theft prevention program that detects, prevents, and mitigates identity theft in covered accounts — and evidence that flagged cases were actually reviewed by a person.

What Quikdealer does

• Identity red flags surfaced on the customer record while the deal is being worked, not after
• A compliance desk where flagged cases queue for review
• Reviewer, decision, and timestamp recorded against the case
• Deals carry their compliance state, so an unreviewed flag is visible to the desk

What you can show

A list of every flagged customer with who cleared it, when, and on what basis.

What it requires

When credit is declined or offered on materially worse terms, the applicant is entitled to a notice with the specific reasons and, where a consumer report was used, the source of it — within statutory timelines.

What Quikdealer does

• Adverse-action notices generated from the deal, with the reasons recorded rather than retyped
• The notice is a first-class document in the same engine that renders the bill of sale
• Delivery and signature state tracked on the envelope
• The decision, its reasons, and the notice are chained into the audit log

What you can show

The rendered notice, its delivery record, and the audit entries linking the credit decision to the notice that followed it.

What it requires

You may not transact with sanctioned parties. The list changes constantly, so screening against a stale copy is a compliance failure even if the screen itself 'passed'.

What Quikdealer does

• The SDN list refreshes on a daily job
• An alert fires if no refresh has succeeded in 36 hours — staleness is treated as an incident, not a warning
• Customers are screened as part of the deal flow
• Screen results, including clears, are written to the audit log with the list version behind them

What you can show

Per-customer screening results with timestamps, plus list-freshness history proving what you screened against.

What it requires

Personal information may only be collected with meaningful consent for an identified purpose, and individuals can ask what you hold about them, ask for it, and ask you to delete it.

What Quikdealer does

• Consent text stored verbatim at the moment of capture, so the record shows what the customer was actually shown
• Purpose recorded alongside the consent
• Data-subject access and erasure handled as a built-in flow, not a manual database chore
• Personal identifiers encrypted with per-dealership keys

What you can show

The exact consent wording a given customer agreed to, when, and the fulfilment record of any access or erasure request.

What it requires

Contracts of adhesion and related documents must be provided in French. A customer may agree to proceed in another language only after the French version has been made available to them.

What Quikdealer does

• Documents render French-first for Québec rooftops, with bilingual layouts where both are needed
• The French template is the source, not a machine translation of the English one
• The whole customer-facing product — portal, signing flow, notifications — is available in French
• Locale is a property of the rooftop and the customer, so it can't be forgotten at print time

What you can show

The French document as issued, from the same render pipeline that produced the signed copy.