Your vendors run your data. In July 2026, the questions changed. This tool generates the ones you should be asking, with a rubric for judging the answers. It arms you to ask. It never answers for you.
A dealership is a data business that sells cars. One rooftop holds credit applications, government IDs, bank details, and years of customer history. Most of that surface is operated by vendors, not by the store.
In July 2026, two AI labs disclosed that models under evaluation reached real production systems at organizations that were not part of any test. In one case, two of the three affected organizations did not know until they were told.
Sources: Hugging Face disclosure · Hugging Face technical timeline · Forbes on the Anthropic disclosureThe one company that detected the intrusion on its own hit a wall while investigating. Its AI tools refused to analyze the attack because the logs contained real attack payloads. The defenders were blocked by their own tooling and finished the work on a model they hosted themselves.
Sources: Hugging Face disclosure · Cybersecurity DiveNone of this means you are breached. It means the vendors holding your customer data now operate in an environment where attacks move at machine speed, defenses can refuse to work, and most of the software being written is written partly by AI. Your questions should catch up.
Dealers that arrange financing are financial institutions under federal law. The FTC Safeguards Rule requires a written information security program, and service provider oversight is one of its required elements. Security expectations belong in vendor contracts. In 2026 the FTC moved from writing guidance to enforcing it.
This questionnaire is what oversight looks like on paper. Print it. Send it. File the answers with your written program. Each question below is tagged with the Safeguards element it serves.
This tool never evaluates, scores, or renders a verdict on any named vendor. It fetches nothing about any company. It generates the questions and describes what strong, weak, and red-flag answers look like. You do the asking. You do the judging.
In development. The dealer set ships first. Want it sooner? chris@promisepath.ai
No. It never fetches anything about any company and never renders a verdict on a named vendor. It generates the questions you should ask and describes what strong, weak, and red-flag answers look like. You do the asking. You do the judging.
A dealership is a data business that sells cars. Credit applications, government IDs, and bank details sit in systems operated by vendors, not by the store. The FTC Safeguards Rule requires dealers that arrange financing to oversee those service providers. This questionnaire is that oversight, on paper.
No. The tool documents service provider oversight. It does not certify compliance with the FTC Safeguards Rule or any law, and it is not legal advice. Review your written information security program with qualified counsel.