Security & Trust
Built to hold a dealer group’s data.
LotHours handles employee time, location, and payroll data across every rooftop you run. Here is how that data is protected — described plainly, without security theater.
Strict per-dealership isolation
Every dealership's data is walled off from every other. Access is scoped to your organization at the database layer, and a cross-tenant isolation test suite runs on every single deploy — a release cannot ship unless it proves, end to end, that one dealership can never read another's time events, timesheets, sites, messages, or people. Isolation is a release gate, not a promise.
Role-based access
Org owners, site admins, department managers, and employees each see only what their role and their rooftop allow. A service writer sees their own hours; a GM sees their store; corporate sees the group. Multi-rooftop groups get org-wide administration without flattening who-can-see-what.
Audit trail
Administrative actions — creating or archiving a site, setting a rooftop's labor jurisdiction, inviting or removing people, payroll configuration — are written to an append-only audit log with the actor, target, and timestamp. When you need to answer "who changed this, and when," the record is already there.
Passwordless authentication
Employees sign in with a one-time email code — we never store employee passwords, so there is no password database to leak. Sessions are short-lived and scoped to the signed-in person's organization and role.
Encryption & infrastructure
Data is encrypted in transit (TLS) and at rest by our infrastructure providers, and served from US regions. LotHours runs on managed, industry-standard cloud infrastructure (Vercel and Supabase/PostgreSQL), so patching and hardening of the underlying platform are handled continuously.
Data ownership & privacy
Your roster, hours, and location data are yours. We do not sell personal data, and we do not share employee phone numbers or message content with third parties for marketing. See our Privacy Policy for exactly what we collect and why.
For dealer groups
Rolling LotHours across a multi-rooftop group brings your IT and legal teams into the conversation. We work with them directly. For an enterprise deployment we will:
- • Walk your security team through our isolation model and answer a security questionnaire.
- • Provide a Data Processing Agreement covering how employee data is handled.
- • Discuss data residency and retention to match your requirements.
- • Scope single sign-on (SSO/SAML) against your identity provider so staff use existing corporate logins.
We’d rather tell you what we do and don’t have than overstate it. If there’s a control your group requires that isn’t listed here, ask — we’ll give you a straight answer.
Talk to us about an enterprise rolloutA note on labor-law compliance
LotHours applies each rooftop’s state overtime and meal/rest-break rules automatically from its address, and shows which jurisdiction is active on every site. These are configurable adult private-sector compliance defaultsto support your payroll decisions — they are not legal advice, and they don’t encode every minor-employee or local ordinance. For questions specific to your workforce, confirm with counsel.
More on data handling in our Privacy Policy.