Security at EVIQ

Four principles drive every technical decision at EVIQ:

1. Least privilege. We ask for the smallest possible Tesla scope needed to compute your EVIQ Score™ — and nothing more.
2. Encryption everywhere. TLS 1.2+ in transit; AES-256 at rest for any token we must persist.
3. Read-only by design. The application binary literally does not import any Tesla command endpoints. See §4.
4. Owner override. Revoke access in one click. Delete your account in one email.

EVIQ uses Tesla OAuth 2.0 with PKCE. When you click “Sign in with Tesla,” EVIQ redirects your browser to Tesla’s own authentication server at auth.tesla.com. You enter your Tesla credentials directly with Tesla — EVIQ’s code path is never in the loop.

When you approve access, Tesla redirects your browser back to our OAuth callback at eviq.pro/api/tesla/callback with a short-lived authorization code. Our server exchanges the code (server-to-server) for an access token and a refresh token. Only the refresh token is persisted, and it’s encrypted before it touches disk.

You can revoke EVIQ’s access at any time from Tesla → Account & Security → Third-Party Apps, or by clicking “Disconnect Tesla” in EVIQ. Revocation is honored immediately by Tesla; we honor it on our next scheduled sync.

• In transit: TLS 1.2 or higher for every connection between your browser, EVIQ’s servers, Tesla, Stripe, and every third-party service listed in our Privacy Policy.
• At rest: Refresh tokens are encrypted with AES-256-GCM using a key stored in a separate, access-audited secret manager. Our database provider additionally encrypts underlying disk volumes.
• Payment data: Card numbers, CVCs, and expiration dates never touch EVIQ’s infrastructure. Payment fields render inside our processor’s (Stripe) PCI-DSS-compliant iframe.

EVIQ requests read-only Tesla scopes. The application does not include, import, or otherwise link the Tesla Command Signing library, and it does not call any command endpoint. Concretely, EVIQ cannot:

• Unlock, lock, or open the trunk/frunk of your vehicle.
• Start, stop, or throttle charging.
• Precondition the cabin.
• Honk, flash lights, or summon.
• Change any setting, name, or Autopilot preference on your car.

EVIQ can only read the vehicle information you approved during OAuth — identity (VIN/model/year), battery diagnostics, charging session history, and odometer.

Tesla’s OAuth flow is designed specifically to keep third-party applications like EVIQ out of the password handoff. Your password goes from your browser directly to auth.tesla.com — it never transits, and is never seen by, EVIQ.

• Application hosted on a SOC 2-audited Kubernetes platform with automatic patching and isolated tenant workloads.
• Database on MongoDB Atlas with disk-level encryption, private networking, and automated backups.
• Secrets managed via a dedicated secret store, not committed to source.
• Deploys are immutable and versioned; rollback is a one-click operation.

Found a vulnerability? Please email support@eviq.pro with subject “Security disclosure”. We ask that you:

• Give us reasonable time (typically 90 days) to remediate before public disclosure.
• Do not attempt to access, modify, or destroy any user data that is not your own.
• Do not perform any denial-of-service tests against our production environment.

We do not currently offer a paid bug-bounty, but we credit reporters in our release notes (with their consent) and are happy to write a reference letter.