Security
Draft for review. Every statement here must be true at launch. We will check each one against the real system before publishing.
Principles
- Collect less. Data we never store cannot leak. We do not store video, audio or camera feeds.
- Use Tesla's official channels. We use Tesla's published Fleet API and Fleet Telemetry service, and you approve access on Tesla's own sign-in page.
- Least privilege. We ask Tesla for only the permissions the app needs.
What we do
- Encrypt data in transit with TLS. The car connects to our telemetry server using mutual TLS, so the server and the car identify each other.
- Encrypt Tesla access and refresh tokens at rest with AES-256-GCM, using a key that is kept apart from the database. Our own sign-in session tokens are stored only as one-way hashes.
- Keep our signing key for vehicle commands on our server only, out of source control and never shared.
- Restrict server access to key-based authentication, with password and root login disabled and a firewall that opens only the ports we need.
- Keep systems updated, and limit who can access production.
- Let you delete your data and revoke access at any time.
What you can do
- Use a strong passcode on your phone and a unique password and two-factor sign-in on your Tesla account.
- Check the keys on your car (Controls, then Locks) now and then, and remove ones you do not recognize.
- Only install Kovert Watch from the official App Store or Google Play pages linked from this website.
Report a vulnerability
If you find a security problem, email [email protected] with the details and steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing. We will acknowledge your report and keep you informed.