Always-audit-ready
cybersecurity for the
lenders you actually run.
Linchmark is the continuously-monitored compliance platform built for independent auto dealerships, mortgage brokers, and small insurance agencies handling customer financial information. One dashboard, one score, one audit-ready evidence pack — without rebuilding it in a spreadsheet every quarter.
- P1Enable MFA on 3 admin accountsM365
- P2Vendor questionnaire overdue: CRM providerVendor
- P3Phishing sim cohort 4 — score 18% fail rateTraining
- P4Update access log retention to 7 yearsPolicy
One dashboard. Five loops that never stop running.
Designed for owners who don’t want to become CISO. Each loop below replaces the spreadsheet, the vendor email thread, and the “we’ll get to it next quarter” — and keeps evidence fresh in the background.
- DealerCenter DMSMedQ3
- Stripe PaymentsLowQ4
- HubSpot CRMMedoverdue 23d
- Slack (NPI scope)LowQ2 ✓
All employees with access to customer NPI authenticate via SSO + hardware-key MFA. Access reviews quarterly, approved by the dealership principal; revocations logged within 24 hours.
- 0101 · WISP · Pinewood Auto Group.pdfready
- 0202 · Risk Assessment · FY 2026.pdfready
- 0303 · Vendor Register · 23 vendors.xlsxready
- 0404 · Questionnaire · HubSpot CRM.pdfready
- 0505 · Incident Response Runbook.pdfready
- 0606 · Training Roster · Q3.pdfready
- 0707 · Evidence Index.pdfready
From questionnaire to evidence pack in under an hour.
- 01
Guided onboarding questionnaire
Twenty minutes about your employees, vendors, and existing tools. We use it to scope what we ingest and to seed your first draft WISP.
- 02
Connect Google Workspace or Microsoft 365
Read-only, scoped OAuth. No agents, no agents on employee laptops, no resharing of mail or files.
- 03
Continuous monitoring, quarterly evidence
Admins get a live posture dashboard; principals get a quarterly evidence pack they can hand to anyone who asks.
- 04
Incident response, when you need it
A runbook is ready. Triaged timelines draft themselves — a human reviews, the regulator submission is generated in minutes.
Built for the people who actually ask the questions.
The output Linchmark produces is accepted by the four constituencies that actually move the needle on a small operator’s compliance posture.
- FTC Safeguards Rule · 16 CFR 314
- GLBA Safeguards
- State dealer-board filings
- Cyber-insurance underwriters
- Franchisor annual reviews
- Lender & floorplan reviews
Regulators — templates aligned with the FTC Safeguards Rule and the GLBA Safeguards Rule; submissions draft themselves from your evidence pack.
Franchisors — the annual dealer compliance review no longer needs a binder and a Friday afternoon.
Underwriters — cyber-insurance questionnaires answer themselves from the same evidence — no chasing staff for screenshots.
Lenders— floorplan and partner-bank reviews go from “a week of compiles” to a single signed link.
The packet your franchisor, regulator, or underwriter actually wants to see.
Linchmark maintains a living WISP, risk register, vendor questionnaire, training roster, and incident-response runbook — and binds them into a single signed evidence index whenever a reviewer asks.
- Written Information Security Plan (FTC Safeguards-aligned)
- Risk assessment with severity-tagged register
- Vendor security questionnaires + SOC 2 evidence
- Phishing & training completion records
- Incident-response runbook + post-incident timeline templates
- Quarterly evidence index — PDF + DOCX + spreadsheet
Pinewood Auto Group · FY 2026
All employees with access to customer non-public information are required to authenticate via SSO with hardware-key MFA on a per-app basis. Access reviews are conducted quarterly and approved by the dealership principal; revoked credentials are recorded in the audit log within 24 hours.
Twenty-three vendors hold access to NPI. Each completes an annual security questionnaire tied to their data-handling scope; vendors handling payment or PII are re-reviewed every six months. A current SOC 2 Type II report or equivalent is required from all vendors flagged “high risk”.
Suspected incidents are triaged within one hour by the on-call owner. Notification to the FTC, state regulators, and affected customers follows the runbook attached as Exhibit D. Post-incident review is documented in writing within ten business days and updated policies are re-attested by every employee within 30 days.
Flat per location. No per-seat, no per-document.
Each tier is one flat monthly price per location. Month-to-month; annual prepay available at a discount — and an MSP partner portal for firms who want to offer Linchmark under their own brand.
Single-location dealership or brokerage. Up to 25 employees, two connected identities.
- One M365 / Google Workspace connection
- Annual WISP + risk assessment export
- Phishing simulation — two cohorts / year
- Up to 25 tracked vendors
- Email support
Multi-rooftop dealer groups and small lenders handling modest NPI volume. Up to 150 employees.
- Everything in Starter
- Both identity providers supported
- Quarterly evidence pack, not annual
- Unlimited vendor reviews
- Co-branded partner portal
- Priority support · 1 SLA
Larger dealer groups, regional lenders, and franchisors piloting Linchmark for their dealer network.
- Everything in Standard
- Tenant segregation + per-tenant keys
- Custom evidence pack templates
- Dedicated partner success manager
- Single sign-on into your IdP
- Annual on-site readiness review
Deliver Linchmark under your own brand.
A co-branded partner portal lets you put Linchmark in front of your own customers as your service. We handle the platform, the platform’s compliance, and the evidence drafts — you keep the relationship and the margin.
- White-label customer portal
- Billing pass-through & revenue share
- Co-branded evidence packs
- Dedicated partner success manager
The questions dealers actually ask.
Or write to us directly — we answer every email.
Email Linchmark