Left out by the server, not hidden on the screen.
Eight roles, held per rooftop. Without permission, cost and margin never reach the browser, and customer contacts arrive masked. Pick a role to see the same appraisal through its eyes.
- Offer
- AED 206,000
- Pay up to
- AED 210,300
- Margin at the expected price
- AED 23,242
- Customer phone
- +971 50 123 0100
- Approve offers up to
- Up to AED 250,000
- VAT treatment
- Margin scheme · read only
Every record is checked against this role at its own rooftop.
Swipe the table sideways to see every role →
Defaults. The app names 34 permissions, shown read-only in Settings.
Nobody decides beyond their authority.
Your policies say which offers and price changes need whom, in up to five steps. Each approver's limit comes with their role at that rooftop. The server holds everyone to it, the owner included. Try the policy tester
Sandstone's approval limits · the manager's raised from the AED 150,000 default
- Owner
- No limit
- Used-car manager
- AED 250,000
- Buyer
- AED 100,000
- Everyone else
- Doesn't approve
Nobody decides their own request.
Omar submitted the offer, so someone else decides it. An owner may decide their own request only when nobody else at the rooftop can, and then it is logged as a self-approval.
Nobody decides their own request.
Omar submitted the offer, so someone else decides it. An owner may decide their own request only when nobody else at the rooftop can, and then it is logged as a self-approval.
Append-only, down to the database.
Decisions, price changes, history checks with what they cost, team and settings changes, and stock exports all go on the record, in the same step as the change. A correction is a new entry, never an edit. Try it.
- Who reads it
- Owners and group admins see the whole group. Managers and finance see their own rooftops.
- Taking a copy
- Owners and admins only, with a written reason, up to 5,000 rows. The export is an entry too.
- Sign-ins
- The method, the browser and the country. Never a raw IP address.
- How long
- Everything is kept for now. An organisation is closed, never deleted, so its log survives.
- 09:31Omar HaddadAppraisalsAPR-0381 · Submitted for approval at AED 206,000
- 09:42Rania SaadehAppraisalsAPR-0381 · Step 1 of 2 approved at AED 206,000
- 09:43Faisal RahimiAppraisalsAPR-0381 · Approved at AED 206,000
- 10:15Faisal RahimiStock2021 GMC Yukon Denali · Price change approved · AED 134,900 → AED 123,700
- 11:05Dana YousifAppraisalsAPR-0381 · VAT treatment confirmed: Margin scheme
- 11:20Mei TanStockExported 64 cars
When someone leaves, their access leaves with them.
Deactivating someone signs them out on every device at once. What they appraised, approved and priced stays, under their name. The seat is free for whoever comes next.
- Only owners and group admins manage the team, and each change needs a recent sign-in.
- Nobody changes their own access, or grants more than they hold.
- The last admin can't be removed, so the group is never locked out.
- Invitations are single-use and expire after 7 days.
- A changed role or rooftop applies on the person's next click. Nobody needs to sign out.
- Every change to the team is on the audit log.
Market data comes in. Your customers stay put.
AutoData supplies the vehicle and market data, and DealRevs calls it from its servers only. Your customers' details never go the other way. In the market feed, sellers' names stay on our servers, and an advert's VIN is kept only as a fingerprint.
- Catalogue · about 40,000 configurations
- VIN decoding, with a match level
- Reference values · monthly at best
- Import check and vehicle history
- The daily listings feed
- Organisations
- Users
- Appraisals
- Customers
- Stock
- Approvals
- Deals
- The audit log
In DealRevs' own database. The dealer is the data controller, and consent is stored with the wording the customer saw.
How customer data is handledWhat we can see, and what we can't.
The DealRevs team runs the platform, not your dealership. Our admin area manages groups and invitations, and stops at your door.
We can
- Set up your group
- We create the organisation and its rooftops, and invite the owner who runs it.
- See who's on the team
- Names, e-mail addresses, roles and seats, so we can help with access.
- Load files you send us
- If you ask our engineers to import your stock, they work from the file you give them.
We can't
- Open your records
- Appraisals, customers, stock, prices, deals and approvals aren't in our admin area at all.
- Sign in as one of your people
- There is no “log in as”, so nothing is ever done under one of your people's names.
- Set you up unseen
- Creating your group and inviting its owner are written to your own audit log, under Team.
One exception, outside the app. Our engineers can query the database directly. Reading a dealer's records that way needs a named approver at AutoData to say yes each time, and because it happens outside the app, it isn't in your audit log.
Check your e-mail
If omar@sandstone.example.com has a DealRevs account, we've sent it a 6-digit code. It expires in 10 minutes.
Sign-in code
A code by e-mail, or a password, in the browser or the app.
- E-mailed code
- 6 digits · 10 minutes · 5 tries
- Password
- 10–200 characters · locks after 10 failures
- Sessions
- 90 days · 30 idle · end any session anywhere
- New browser or phone
- An alert by e-mail
- Decisions in the app
- Face ID or the passcode first
- Accounts
- Existence is never revealed
- Team changes
- Need a recent sign-in
Questions IT will ask
Where is our data held?
On Cloudflare. As of October 2026 the app runs on Cloudflare Workers pinned to London, and its databases are in Western Europe. Photos and documents sit in private Cloudflare storage. Nothing is hosted in the GCC today.
How is our data kept apart from other dealers'?
Every query is scoped to your organisation, and the organisation comes from the sign-in, never from the browser. Underneath, the database refuses any record that points at another organisation's data. An end-to-end test checks that another group's records come back as not found.
Is it encrypted?
Every connection is HTTPS, and browsers are told never to use anything else. Stored data is encrypted at rest by Cloudflare. Photos and documents open only through signed links that expire within an hour.
What about backups?
The databases run on Cloudflare D1, which can restore to an earlier point in time, and every release records a restore point before it goes out.
Is there single sign-on or two-factor sign-in?
Not yet. People sign in with a 6-digit code sent to their e-mail, or a password. Passwords and codes are stored only as one-way hashes, never as text. Single sign-on with Google or Microsoft is planned but not connected; tell us if you need it.
Who else handles our data?
Cloudflare hosts the app, the databases, files and e-mail. Sentry, in its EU region, receives error reports without user details, cookies or request contents. PostHog, in its EU region, records how people use the app so we can improve it, including recordings of sessions: everything typed is hidden, photos, VINs and UAE mobile numbers are blanked, and passwords, sign-in codes and private links never leave DealRevs. AutoData Middle East, which makes DealRevs, receives VINs to decode them and run history checks, never customer details. There is no SMS provider.
How long do you keep our data, and what if we leave?
For now, everything is kept. Owners, admins, managers and finance can export stock and Insights as CSV at any time, and owners and admins the audit log. If you leave, your organisation is closed rather than deleted, because its audit log can't be deleted. A request to remove a customer's details is handled by our team: their name, phone and e-mail are removed unless a deal record needs them.
Which security certifications do you hold?
None yet, and we won't pretend otherwise. Send us your questionnaire and we'll answer it in writing. In the meantime: every change to the code is reviewed and tested before release, secrets are scanned for, dependencies are kept up to date, and every page sets a strict content security policy.