Passkeys or an authenticator. No exceptions.
Anyone who can list, bid, approve or sign uses one. A password alone never moves a car.
Security and privacy
Private by design.
Built around your group: strong sign-in for everyone with authority, data kept apart row by row, signatures you can verify, and nothing held that a dealer marketplace does not need.
Your group only.
Each group's data is kept apart at the database, row by row. Nobody outside your group sees a listing, a bid or a name.
Sealed, verifiable signatures.
A signed bill of sale is an unchangeable PDF with its signature record. Verify any copy later.
An audit trail for everything.
Listings, bids, approvals, signatures and every report download, with who and when.
No consumer data.
Vehicles and work accounts only. The terms say not to add retail customers' information.
Software. Not a middleman.
Not a dealer, broker, auctioneer or escrow holder. Rooftop never touches the money or the title.
Signing in
- Email and password with a verified email address, passwords of at least 12 characters, and password recovery.
- Everyone who can list, bid, approve or sign must also use a passkey or an authenticator app. The terms require it, and the app enforces it.
- Recovery codes are stored hashed. A lost phone does not mean a lost account, and a found code does not mean a found one.
Your group, and only your group
- Each group's records are kept apart in the database itself, row by row, not only in the screens. The app runs under a database login that cannot switch that off.
- Nobody outside your group sees a listing, a bid, a price or a name. Inside the group, a bidding store appears as "another store" to everyone but itself.
- The wholesale value and the reserve a seller types stay with the selling store.
Signatures that hold up
- Each signer reads the document, confirms who they are with a one-time code sent to their verified email, and gives consent. The record keeps the typed name, a drawn signature if one was drawn, the time, the consent, and the IP address and browser used.
- The signed bill of sale is an unchangeable PDF, sealed with its signature record and signed with a key held in a hardware-backed key service. Any copy can be verified later.
- No third-party e-signature vendor is involved. The terms rely on the federal ESIGN Act and Michigan's Uniform Electronic Transactions Act.
An audit trail for everything
- Listings, bids, approvals, signatures, settings changes and every report download are recorded with who did it and when.
- Operational logs record the page requested, the result and how long it took. No IP address. They are kept 30 days, inside Rooftop's own database and not on a logging service.
What Rooftop does not hold
- No retail customers' information. Rooftop holds vehicles, work accounts and the documents your stores sign, and the terms say not to add more.
- No card numbers. Stripe collects and holds payment details; Rooftop keeps a customer reference and the subscription's status.
- No money and no titles. Rooftop is software, and is not a party to any transfer.
AI is off until you turn it on
- The optional AI features (searching in a sentence, matching a spreadsheet's columns) are off for every group until an administrator switches them on.
- When they are on, only the search sentence you type or a spreadsheet's column headings are sent to the AI provider. Never inventory records, documents or personal details.
- Everything works without them.
Integrations you control
- API credentials and OAuth clients are scoped to what you grant. A secret is shown once, stored hashed, and expires after 90 days.
- Integrations can read, and can prepare drafts. Activating stores, publishing, bidding, approving and signing are done by people in the app.
Leaving, and deleting
- Export first: the records workbook and every bill of sale are yours to keep.
- Deleting a group starts a 14-day read-only wait that any administrator can cancel. After it, the group's records and files are permanently deleted, and backup copies expire within 35 days.
- The one exception: Rooftop keeps the agreements you signed with it, and their signature records, for 6 years, then deletes them.
The full text
- The privacy notice says what is held, who helps provide the service, and how long each thing is kept.
- The terms of service say what Rooftop is and is not, and what each side is responsible for.
- Found a security problem? Tell us and we will answer.
Your move
Your group's inventory, finally working together.
Setup takes minutes. Your first aged unit can be in front of your sister stores today.