Security
Built for the data your service drive depends on.
Voice recordings, repair-order data, vehicle history, customer information — every byte handled like it's sensitive, because it is.
How we protect your data.
Your data, your control
You own your customer data. Manifold processes it on your behalf as a service provider — never as a controller — under a written agreement that defines exactly how and why.
No model training on your data
We don't use your technician dictation, recordings, or repair-order content to train models that are made generally available outside your dealership without your written authorization.
Encryption end-to-end
All audio, video, and structured data encrypted in transit (TLS 1.2+) and at rest (AES-256). Keys rotated regularly and managed via cloud KMS.
Role-based access control
Technicians see their bays. Advisors see their lanes. Warranty admins see claims. Service Directors see the full P&L. Permissions are enforced at the API layer — not just the UI.
Audit logging
Every read, write, export, and admin action is logged with timestamp and user identity. Logs are retained for 12 months minimum and available to your dealership on request.
Independent review
Continuous vulnerability scanning against every deploy. Third-party penetration testing on an annual cadence. Findings remediated and re-tested — not just filed.
Compliance & controls.
Manifold is a young company in active certification. Here's where we are today, and what's on the roadmap.
SOC 2 Type II
Information security & operations
In Progress · Audit Q3 2026
CCPA
California consumer privacy
Compliant
ISO 27001
Information security management
Planned · 2027
Need a current attestation, SIG, or third-party assessment summary? Email our security team and we'll send what's available today.
Security is fundamental to everything we do.
Common questions from Service Directors and IT teams. If yours isn't here, we'd rather hear it directly.
How does Manifold protect customer data?
Customer data is encrypted in transit and at rest, scoped per-dealership, and accessible only through authenticated API requests. Internally we apply principle-of-least-privilege — most engineers don't touch production customer data day-to-day.
Do you use customer data to train AI models?
No. We don't use your dictation, recordings, or RO content from paid services to train models made generally available outside your dealership without your written authorization. Your data is yours.
Where is my data hosted?
Manifold's primary infrastructure runs in AWS regions inside the United States. Customers with specific localization or sovereignty requirements can discuss alternative regions during contracting.
How do I revoke access for a former employee?
Account access can be revoked immediately by your Service Director or another dealership admin. All active sessions for that user terminate within seconds. Audit logs preserve their prior activity for the standard retention window.
What happens to my data if I cancel?
On termination, we export your data on request and then delete it from our production systems within 30 days. Backups roll out of retention within 90 days per policy. Final deletion certification is available on request.
Can I get a Data Processing Agreement?
Yes. We offer a standard DPA covering data handling, sub-processors, security obligations, and breach-notification timelines — written for processor/controller separation between Manifold and your dealership. Contact us to receive the current version.
How often do you run security audits?
Continuous vulnerability scanning runs against every deploy. Annual third-party penetration tests cover the application surface and infrastructure. We share executive summary results with customers under NDA.