Built like infrastructure, because that is what it is.
Single-tenant isolation, hashed identifiers, an event-sourced record, and no raw customer data crossing a boundary. If you cannot audit how a number was produced, it is not a number you should act on.
Data flow
First-party tag, server-side events, webhook and SFTP connectors. Identifiers are hashed at the edge before they travel.
Append-only and immutable. Every view downstream is a projection, so any figure can be replayed back to the events that produced it.
Deterministic keys resolve first. Inference fills the gaps under a confidence floor you set. Every merge is versioned and can be reversed.
Reconciled views, warehouse sync, and a REST and GraphQL surface. Your data leaves in your format whenever you ask for it.
Security posture
Your data never sits in a pool with somebody else's.
Each tenant gets isolated storage and its own encryption keys. There is no shared identity graph sold back to the market, no modeling across clients, and no route by which one dealer's customers end up in another dealer's targeting.
- AES-256 at rest, TLS 1.3 in transit, per-tenant key rotation
- SHA-256 hashing applied before any identifier leaves the edge
- Role-based access, with every read and write recorded
- Deletion requests honored across the graph within 30 days
- Contractual exit: full export, then verified destruction
- Single sign-on with SAML and SCIM, enforced multi-factor authentication
- Least-privilege service accounts, scoped API keys, no shared credentials
- Annual third-party penetration testing, with the report available under NDA
- Point-in-time recovery from encrypted backups, restores rehearsed quarterly
- Named incident response owner, dealer notified within 72 hours
| Event | What is recorded | Actor |
|---|---|---|
| identity.merge | Both source records, the matching keys used, and the confidence score | System |
| identity.split | The reversal, who requested it, and the state before | User |
| ledger.attribute | The deal, the touch path, and the spend assigned to it | System |
| rule.block | The rule that fired and the content it stopped from publishing | Governance |
| audience.push | The segment definition, destination, and suppression applied | User |
| export.request | What left the tenant, in what format, and on whose authority | User |
Connectors
It reads what you already run.
Standard connectors for the systems most stores are on. Anything else goes through the API or a flat-file feed.
Deal records, service repair orders, parts, customer master, inventory
Leads, activities, consent state, sales assignment, appointment history
Sessions, vehicle detail views, form fills, chat transcripts, click to call
Google Ads, Meta, programmatic display, paid social, retail media
Inventory feeds and referral capture from assistant-driven search
Snowflake, BigQuery, Redshift, or scheduled export to your own storage
Send your security questionnaire. We answer it before the first call, not after the contract.
No slidewareBook a walkthrough