SDRM Terms and Conditions

VSP Registry & Secure Data Release Model Terms and Conditions of Use

1. Preamble, Purpose & Definitions
2. Policy

Appendices:

Appendix A – CONTACT INFORMATION
Appendix B – REGISTRY DENIAL AND DISPUTE RESOLUTION APPEAL PROCESS

Appendix C – PRIMARY ACCOUNT BUSINESS LICENSES/DOCUMENTS

Appendix D – POSITIVE IDENTIFICATION/PROOF OF AUTHORITY

Appendix E – LOCKSMITH LICENSE REQUIREMENTS

Appendix F – APPLICATION CHECKLIST

1. Preamble, Purpose & Definitions
   • 1. The work and intent of the National Automotive Service Task Force, hereafter referred to as “NASTF”, and the Vehicle Security Team, hereafter referred to as “VST”, is to provide secure access to security related service information, including key codes, immobilizer reset information, security Personal Identification Numbers (PINs) and other information necessary to successfully enter, start and operate automobiles and light trucks at the request of retail consumers and commercial entities or municipalities that can demonstrate ownership of the vehicle.
   • 2. The Vehicle Security Professional Registry, hereafter referred to as “the Registry” and Secure Data Release Model, hereafter referred to as “SDRM”, give automakers a flexible system to support 24/7 access to vehicle security information for pre-approved locksmiths and technicians. It allows aftermarket service providers to support consumer needs without undermining the integrity and basic purpose of the vehicle security systems.
   • 3. This secure access to security related service information can include, but is not limited to, mechanical key codes, electronic key codes, immobilizer reset codes, PIN codes, immobilizer seed and key system information, radio lockout codes, remote codes, security related access to vehicle networks, confirmation of credential for security parts purchase, tool access authorization and successor technologies.
   • 4. For the purposes of this document, automobile and truck manufacturers will be collectively referred to as “automakers”.
   • 5. For purposes of “the Registry” and “SDRM”, automobiles are defined as passenger vehicles and light trucks are defined as pickup trucks, SUVs, vans and other light duty vehicles, excluding house cars, motor homes, motorcycles or other two-wheeled motor vehicles.
   • 6. “The Registry” has been established in cooperation with participating automakers to facilitate the availability of security related service information to Vehicle Security Professionals, hereafter referred to as VSPs, to support vehicle owners.
   • 7. Once accepted into “the Registry”, every “VSP” will be assigned a unique Vehicle Security Professional Identification number, referred to hereafter as “VSP ID”
   • 8. NASTF reserves the right, in its sole discretion, to change these terms and conditions at any time as needed to respond to security threats.
   • 9. NASTF reserves the right, in its sole discretion, to determine a breach in any term or condition set forth herein, and that all determinations of the “Registry Manager” upheld by the NASTF Appeals Review Process are final.
2. Policy
   • 1. Under the “SDRM”, security related service information is typically obtained directly from participating automakers through internet websites and/or similar successor technologies. Automakers may require individual registration, subscriptions, and/or use fees and adherence to their own terms and conditions for use of/access to the websites.
   • 2. To gain access to security related service information from participating automakers, all users must be pre-validated by enrolling in “the Registry” and undergoing a criminal background check process.
   • 3. “The Registry” is maintained by a registry manager appointed by NASTF (the “Registry Manager”). The Registry Manager oversees the operation of the Registry on behalf of “NASTF”. Contact information is identified in APPENDIX A – Contact Information.
   • 4. “The Registry” is only available for use by individuals working in businesses (sole proprietorships, partnerships and corporations) that have a U.S. Federal taxpayer identification number or Canadian Business Number (which must be provided during the application process), are properly licensed and registered in all municipalities in which they do business, are in good standing in the jurisdictions where they conduct business and whose primary business provides repair or replacement services directly to the registered owners of the automobile for which the security related service information is being obtained to include privately owned, business owned, government owned vehicles (sold in North America) and in instances where a power of attorney has been granted in the case of collision repair or estate management of a deceased owner. Any other uses are at the sole discretion of participating automakers.
   • 5. Registry VSP ID account holders fall into three categories, “Primary”, “Subordinate” or “Company Admin”. All registry applicants must be at least 18 years of age at the time of application and be authorized to work in the U.S. or Canada. NOTE: All Canadian accounts must be registered as a Primary VSP.
     • 5.1. Issued “VSP ID Registry” credentials are ONLY issued to persons who apply to access the registry who have granted access to obtain and utilize the information from automaker websites to service vehicles. “The Registry” credentials do not extend to other employees within the business. Each member of the business staff will need to apply and be issued their own VSP ID credentials to use the automakers websites to acquire vehicle security data. Business owners should apply for additional primary and subordinate accounts deemed necessary to support their business operations. It is to be understood that sharing VSP ID account credentials between employees and technicians is not permitted by the automakers.
   • 6. The Primary VSP ID account holder is often, but not required to be, the business owner. In a multiple VSP business, the primary account holder should be the person directly managing any subordinate accounts. The Primary VSP ID account holder will be required to register individually. The Primary account holder is responsible for all transactions and registry activity that occur on the business’ account.
   • 7. The Primary VSP ID account holder may:
     • 7.1. Add a Subordinate by completing an application in the SDRM Portal https://sdrm.nastf.org
     • 7.2. Change account access permissions for a “Subordinate or Company Admin”
     • 7.3. Manage account information for the business (phone numbers, addresses, e-mail addresses, etc)
     • 7.4. Sub-Accounts are only available in the US to W2 employees working in the US. All Canadian accounts are to be registered as Primary VSPs.
   • 8. The Primary VSP ID account holder is responsible for all transactions that occur by Subordinate VSPs.
   • 9. The Primary VSP ID account holder must be located within a “reasonable distance” of the subordinate’s location to be able to properly manage operations.
     • 9.1. “Reasonable Distances” will be determined by the Registry Manager based on various criteria such as distance, business organizational plans, number of VSP ID accounts, and potential security risks.
   • 10. Subordinate VSP ID account holders must manage their own passwords and generate Positive ID/Customer Authorization (D1) Forms.
   • 11. Requests for support for Subordinates outside of these two areas shall be submitted by the Primary account holder.
   • 12. Sub-Accounts are only available in the US to W2 employees working in the US. All Canadian accounts are to be registered Primary VSPs.
   • 13. Upon acceptance into “the Registry”, every VSP ID account holder, Primary, Subordinate or Company Admin, is assigned their own unique VSP ID that is associated with the registered business.
   • 14. Subordinate VSP ID account holders require background checks that are performed by NASTF to the same standards as Primary account holders.
   • 15. The Company Admin account holder is an account that allows the business to identify individuals who may assist with starting Customer Authorization forms and updating company documents within the SDRM portal. This account does not have access to security operations on automaker websites. The Primary VSP ID account holder will be required to register and manage Company Admin accounts.
   • 16. Subcontractors: A business using “the Registry” shall not provide vehicle security information acquired through use of “the Registry” to a subcontractor or an independent contractor (as determined in accordance with the Internal Revenue Code and related rules and regulations).
   • 17. A business using “the Registry” (Business A) may use subcontractors and / or independent contractors who are also registered VSP ID account holders under a different business account (Business B); however, Business B must acquire their vehicle security information under their own VSP ID business account and complete the appropriate customer authorization form for the operation.
   • 18. It is a violation of the law for a VSP to access information on an automaker site without proper authorization or to use it in an unauthorized manner.
   • 19. The Information, if mishandled, may pose a risk of property loss to the Vehicle Owner or others. Therefore, all VSP ID account holders shall:
     • 19.1. treat the Information as strictly confidential;
     • 19.2. the Information is for single use and not to be stored;
     • 19.3. the information is not to be transmitted electronically;
     • 19.4. take all measures necessary to keep the Information secure, including, but not limited to, all measures requested by the automaker and NASTF;
     • 19.5. not disclose the information to anyone other than the Vehicle Owner, or his/her designee; and
     • 19.6. not use the Information for any unauthorized purpose whatsoever.
   • 20. Expiration of VSP ID account: A VSP ID account is valid for two years.
   • 21. Prior to account expiration, a renewal application must be submitted along with the appropriate fees and other information as indicated on the Registry website; adequate time must be provided for application validation and new background check to avoid gaps in information accessibility. NASTF recommends submitting renewal applications 60 days in advance and no less than 30 for uninterrupted access.
   • 22. Initiating a dispute or chargeback with your credit card company without first opening a support case with NASTF shall constitute a violation of the Terms and Conditions and may result in permanent suspension from the Registry. If you wish to withdraw your application contact https://support.nastf.org/ and provide a reason for withdrawal. Your request will be honored if the request comes later than 24 hours after the application is submitted and if the VSP ID has not been used to obtain vehicle security information. The $100 application fee will become nonrefundable after that window.
   • 23. If the applicant violates the terms and conditions and/or attempts to mislead the NASTF registry team by entering or providing fraudulent information or altered documents, the application or account will be permanently suspended and refund requests will not be honored. After the approval of an application, credit card charge backs will be classified as fraud. NASTF will, at its discretion, forward information concerning fraudulent acts to law enforcement for review.
   • 24. When a Primary VSP ID account holder’s account expires, the accounts of all Subordinate VSPs shall be suspended until the primary account is renewed and approved.
   • 25. If any of the requirements for a VSP account change status during the two-year term of registration (i.e. expiration of insurance, licenses, fidelity bond, termination of a business entity), it is the responsibility of the Primary VSP ID account holder to upload current information within 15 days of the change. If current documentation is not on file in the SDRM portal, all accounts will be suspended.
   • 26. If any required documentation expires during the two-year term of registration for any primary or subordinate account, the Primary VSP ID account holder is required to upload current replacement documents within a 15-day grace period of the expiration. Registry software will attempt to provide email notice as well as notifications upon login prior to expiration, but it is ultimately the responsibility of the Primary VSP ID account holder to maintain current documentation for all business accounts.
   • 27. Conditions of access and use of information acquired through “the Registry”:
     • 27.1. Security related service information acquired through use of “the Registry” is acquired by a VSP ID account holder for the direct and primary benefit of the registered vehicle owner and is provided under the condition that the VSP ID account holder follow all conditions of the “Positive Identification Policy” defined in Appendix D.
     • 27.2. All security related information may only be acquired at the time of service by the VSP ID account holder. The VSP ID account holder must be present with the customer and vehicle to positively confirm ownership and verification of the vehicle prior to utilizing the security related information to service the vehicle.
     • 27.3. It is a violation of the terms of Registry use for a VSP ID account holder to retain, database or electronically transfer any security related information before, during or after a transaction has been completed with the registered owner.
     • 27.4. Security related service information acquired or devices created through use of “the Registry” shall not be sold, bought, traded, bartered or shared in any way with any individual, business, entity, or person(s) other than the registered vehicle owner.
     • 27.5. Under no circumstances shall registry data be used to create and mail a vehicle security device to include keys, fobs or control modules.
     • 27.6. It is a violation of the terms of Registry use for a VSP ID account holder not to respond and/or provide information requested by the Registry Manager during the course of a Registry application or vehicle security information usage audit within 7 calendar days of the audit notification email request and notification being sent.
   • 28. The National Insurance Crime Bureau (NICB) or other law enforcement auto theft related activities: NICB and other law enforcement officials may submit auto theft inquiries to NASTF. If it is determined that there is an auto theft reported by NICB or other law enforcement agencies that is linked to a VSP ID holder, the account will be immediately suspended without notice pending the disposition of the auto theft report.
   • 29. Violations of Registry terms of use: Any VSP ID account holder who is aware of any misuse of the Registry shall immediately report said misuse directly to “NASTF VSP ID Registry” by contacting NASTF support email or phone number (as identified in Appendix A – Contact Information).
   • 30. Upon investigation and verification of misuse, the VSP ID account holder will be suspended from having access to “the Registry” and may be permanently restricted from being issued any subsequent VSP ID number/account.
     • 30.1. Furthermore, upon investigation and verification of misuse not covered by the Terms and Conditions, the VSP ID account holder in accordance with the BYLAWS OF NATIONAL AUTOMOTIVE SERVICE TASK FORCE Article III Section 5: NASTF membership may be terminated by action of the Board of Directors for conduct deemed detrimental to the corporation, for conviction of any crime involving fraud, dishonesty or breach of trust, or for violation of these Bylaws, or any rule of the corporation.  Termination by action of the Board of Directors shall be by at least a two‐thirds vote at a meeting of the Board of Directors; provided, however, that prior to any such action, the Registered Member involved shall be given due notice and shall be entitled to a hearing before the Board of Directors. Termination of membership shall not relieve a Registered Member of any outstanding obligation to the corporation.
   • 31. Failure to report known misuse of the Registry constitutes a violation of the Terms and Conditions of use of the Registry. “Failure to report” may result in removal from the Registry and permanent restriction from being issued any subsequent VSP ID number/account.
   • 32. Sharing of user names and passwords between individuals is expressly prohibited. Breach of this policy will result in action against the VSP ID business owner, including potential removal from the Registry and permanent restriction from being issued any subsequent VSP ID number/account.
   • 33. The VSP ID is to be used by one individual only. This individual must be present and perform the work on the vehicle or, in the case of auto repair, directly supervising the work with a technician.
     • 33.1. Allowing a technician to access the registry does not qualify as supervision.
     • 33.2. A business owner sharing access with the entire shop for Mercedes Benz Theft-Relevant Parts purchases is not an accepted use.
   • 34. All requests for support and technical assistance must come from the registered VSP Primary account holder.
   • 35. When a VSP ID account holder is suspended or terminated from the Registry, they can appeal the action to the NASTF Security Review Committee (the “APPEALS REVIEW COMMITTEE”). The full process is detailed in Appendix B – Registry Denial and Dispute Resolution Appeal Process.
   • 36. Customer information: Use of the Registry may require the VSP ID account holder to collect, review, and record certain Personally Identifiable Information (PII) from the customer. Information that may be required includes, but is not limited to:
     • 36.1. The customer’s full legal name
     • 36.2. Visual verification of a valid vehicle registration document
     • 36.3. Visual verification of a valid U.S. or Canadian driver’s license valid exception would be if the owner’s license had been stolen (See below Appendix D)
   • 37. It is the responsibility of the VSP ID account holder to handle any Personally Identifiable Information in strict confidence of the registered vehicle owner and in compliance with all applicable federal, state and local regulations and/or statutes. (If SDRM software is used to take pictures they will not be stored on the VSPs’ devices)
   • 38. To enroll in “the Registry”, a VSP/business must perform and/or submit by upload the following:
     • 38.1. Complete online Registry Application and confirm acceptance of the User Agreement located at https://sdrm.nastf.org.
     • 38.2. Upload current and legible copies of all required and applicable supporting documents and information.
     • 38.3. A VSP ID applicant will be background checked as per the procedures and to the standards established by NASTF and its background check partner.
     • 38.4. A felony or equivalent criminal arrest or conviction may exclude an applicant. All denied applications can be referred to the NASTF Appeals Review Committee for review at the request of the applicant (see Appendix B – Registry Denial and Dispute Resolution Appeal Process).
     • 38.5. VSP ID account enrollment denials and VSP ID terminations for cause may be appealed to the NASTF Appeals Review Committee through the registry appeals process as outlined in Appendix B – Registry Denial and Dispute Resolution Appeal Process.

APPENDIX A – CONTACT INFORMATION            https://support.nastf.org/

NASTF SDRM Support Desk       Hours 9-6pm Eastern

Roles:

• Registry User Support
• Payment questions
• System use assistance
• Application assistance

 National Automotive Service Task Force SDRM Registry Manager                         

Roles:

• Registry Administration
  • Registry Info & Promotion
• Application Processing
  • Background Checks

 National Automotive Service Task Force Executive Officer/Managing Director     

Roles:

• NASTF Administration
• NASTF Media contact
• OEM point of contact
  • NASTF.org and SDRM website content
• Service Information Requests
• Dispute Resolution
• SDRM Appeals Reviews Committee
• Maintenance and Implementation of OEM Information Standards Agreements
• Assessment of Service Information products and diagnostic tools.
• Identification of gaps in automotive service information, tools, and training.
• NASTF Team Support

APPENDIX B – REGISTRY DENIAL/DISPUTE RESOLUTION APPEAL PROCESS

An applicant or VSP ID account holder will have the right to appeal to the NASTF Appeals Review Committee for the following:

(a) a decision by the Registry Manager to deny the applicants inclusion on the Registry,
(b) a decision by the Registry Manager to suspend or terminate a VSP ID account holder’s access to the Registry, and
(c) a denial by a Participating Automaker to permit access by the VSP ID account holder to Security Data on terms and conditions available to other VSP ID account holders.

RESPONSIBILITIES:

The NASTF SDRM Registry Managers duties, include without limitation:

(1) administering the application process, managing background checks and making approval decisions on applicants based on criteria established by the NASTF Vehicle Security Policy Working Group.

(2) Reviewing all reports of improper use of the Registry, suspending accounts in cases of reported impropriety, and in response to receiving an official appeal, forwarding evidence of said improprieties to the NASTF Appeals Review Committee and Law Enforcement (as appropriate or requested) for final disposition. The Registry Manager is required to take adverse action on a VSP ID account if the NASTF Appeals Review Committee determines that reported impropriety is accurate.

The NASTF Appeals Review Committee is responsible for reviewing and making final decisions on rejected Registry applications that have been submitted for appeal.

The NASTF Appeals Review Committee will have seven (7) members. NASTF Appeals Review Committee members will be appointed by the NASTF Chairman. The NASTF Appeals Review Committee will include one (1) director from the NASTF Board of Directors who will serve as chairman of the Committee, and six (6) members from across all stakeholders in SDRM to include Service Repair, Automakers, Locksmiths and Tool companies. Appointments to the NASTF Appeals Review Committee will be for a period of two (2) years. Committee members may be reappointed and there is no limit on the number of years an individual may serve in this capacity.

Registry Application Denial Appeal Process

The NASTF Registry Manager may deny an applicant inclusion in the Registry for a number of reasons related to providing fraudulent information, prior or continued misuse of the Registry, or non-compliance to automaker policies.  The applicant may use the application denial appeal process by following these steps:

• NASTF Appeals Review Committee: Upon receipt of the denial email notification from the Registry Manager, the applicant has ten (10) business days to provide email notification of an appeal to the NASTF Support Desk. (All support desk contacts are time and date stamped by the system)
• Appeal must be addressed to NASTF-RM@nastf.org
• Appeal should contain supporting documents or information that refutes the Registry Manager’s decision.
• By submitting an appeal, it is agreed that:
  1. The applicant grants permission for the NASTF Appeals Review Committee to access and review the same information that caused the denial for inclusion in the SDRM Registry.
  2. The applicant acknowledges the determination of the NASTF Appeals Review Committee is final and the individual will not seek any remedy, legal or otherwise, beyond the scope of the appeals review A denied applicant cannot reapply for one (1) year from the date of receipt of the denied appeal decision unless otherwise noted in the final disposition NASTF Appeals Review Committee.
• The Registry Manager or designee, upon receipt of the appeal, will provide electronic copies of supporting documents used to deny Registry access to the NASTF Executive Officer and will confirm whether or not the supporting documents and application are complete and sufficient to begin the appeal process.
• Once determined complete, this information will be forwarded to the NASTF Appeals Review Committee opening the Dispute Resolution Appeal process.
• The NASTF Appeals Review Committee will convene a meeting within ten (10) business days of receipt of supporting information from the NASTF Executive Officer or designee.
• The applicant will be notified of the NASTF Appeals Review Committee decision within fourteen (14) days from the date of the NASTF Appeals Review Committee appeal hearing. The notification will be sent to the applicant by email from the account registered with SDRM.

Registry Suspension/Termination Dispute Resolution Appeal Process

The Dispute Resolution Appeal process will allow a Primary VSP ID account holder to submit a rebuttal and appeal to the NASTF Appeals Review Committee in cases where a VSP ID account has been suspended. This is an opportunity for the VSP ID account holder to provide additional information to the NASTF Appeals Review Committee, relevant to their circumstance. The appeals review process is outlined below:

1)  Per Section 2.31, when a VSP knows of another’s violation of the terms and conditions, they are obligated to report said violation along with evidence of said violation to the NASTF SDRM Support Desk. The NASTF Registry Manager, upon receipt of this evidence, shall suspend the account after completing an independent investigative inquiry. The Registry Manager will initiate communications with the VSP ID account holder as it concerns the policy violations allegations.

2)  The VSP ID account holder may appeal against suspension/termination to the NASTF Appeals Review Committee by following steps 2 through 8 of the Registry Denial Dispute Resolution Appeal process.

APPENDIX C – Primary Account Business Licenses/Documents

For California: If operating as an auto repair business in the state of California, it is required to provide a copy of the certificate issued by the California Bureau of Automotive Repair.

For all other states and locksmiths: It is recommended to upload a current dated Certificate of Good Standing from your Secretary of State. These can be obtained in nearly all cases by visiting the Secretary of State website and completing a file download or screen capture.  Your state may not require a “General Business License.” However, in most states a business must register with the state’s Department of Revenue and file a business tax report which would be accepted.

Sole Proprietorships: be sure to acquire appropriate permits and licenses to operate legally.  These permits/licenses would be accepted as business documents.  If you are not required to obtain permits/licenses, you could provide a redacted copy of your current Schedule C (Form 1040), Profit or Loss from Business (Sole Proprietorship) that is signed and dated as submitted to the IRS.  If operation crosses state lines, the business must be properly registered in all states.

APPENDIX D – Positive Identification/Proof of Authority

The Positive Identification of the vehicle owner or proof of legal authority to access a vehicle has been outlined throughout this document. The following are general requirements. NASTF has produced several training videos to assist VSPs in learning to use the electronic D1 (named after this portion of the terms and conditions when the form was physical). These steps can be found within the SDRM Portal. All VSP Account Holders must take the following steps prior to accessing the Information for a Vehicle Owner:

Verify the identity of the Vehicle Owner.

1. Verify ownership of the vehicle. This requires verifying proof of title (or repossession title), vehicle registration, or similar documentation establishing clear ownership or authority to take possession of the vehicle.

1. If the Vehicle Owner is an individual, this requires verifying the requesting individual’s identity through a US or Canadian driver’s license (no other form of identification is accepted. The only valid exception would be if the owner’s license had been stolen and the owner could prove the theft by producing a copy of a police report.  In this case, a passport or other government issued ID can be accepted). A picture of this proof of identity with the method of authorization confirmation (described in Appendix D items 2 and 3) shall be uploaded to the system.

1. If the Vehicle Owner is a lienholder or other corporate entity, this requires verifying the requesting individual’s authority and identity through a driver’s license and photographic proof that the individual is an employee of the Vehicle Owner (e.g. an employee ID card). This ID is not required to be photographed and uploaded.
2. If the Vehicle Owner is a family member, spouse, caretaker or other designated by the authorized owner, this requires verifying the requesting individual’s authority and identity through a driver’s license and photographic or written proof that the individual is a designated person of the Vehicle Owner. This photographic or written proof as well as the designation should be verified by the VSP having direct contact the authorized owner.
3. Verify that the ownership documentation matches the Vehicle Owner’s identity and address (or last name and address if the requesting party is a family member of the registered owner).
4. Verify that the vehicle identification number (VIN) of the vehicle matches the vehicle identification number on the ownership documentation.
5. Comply with all other applicable federal, state, and local regulations and/or statutes.
6. Complete the appropriate electronic NASTF Customer Authorization (D1) form for the type of transaction you perform in the SDRM portal within 5 days of the automaker transaction.
7. If in doubt, please contact https://support.nastf.org/ for assistance.

APPENDIX E – Locksmith License requirements

Many states, Canadian provinces, cities and municipalities require that a security professional possess a locksmith license. To harmonize with these regulations, NASTF will require a locksmith license for anyone who uses the registry to access keycodes. By definition, any individual physically cutting keys will be considered a locksmith by NASTF in all jurisdictions that require a license. Currently, repair professionals who utilize immobilizer codes to replace, calibrate or reprogram modules during the course of repair are exempt from this rule. NASTF will adhere to all municipalities’ rules. If a business operates in one of these locations, regardless of the business’s physical address, the VSP must be credentialed in that locale. The following is a list of areas that require certification and is provided as guidance and may not be all inclusive.

APPENDIX F – Application Checklist

Download PDF copy