Security

Overview

VehicleOS early access runs on managed cloud services with encryption in transit. We design for explainability and least privilege — not enterprise SOC2 certification in Phase 0.

Where data lives

• Hosted early-access app and synchronous API: Vercel (United States regions).
• Postgres database and auth: Supabase (AWS-backed, project region shown in your Supabase dashboard).
• Vehicle OS Connect CLI imports run on your machine — import files are not uploaded to our servers in the v0 CLI flow.

Encryption in transit

• All web traffic uses HTTPS (TLS).
• Database connections from the app use TLS via Supabase connection strings.
• OAuth tokens are handled by Supabase Auth — we do not store your Google or GitHub password.

Access controls

• Production database credentials and Supabase service keys live in Vercel environment variables — never in the browser.
• API routes require a signed-in session; vehicle rows are scoped to your user id on the server.
• The open-core GitHub repo is public for architecture review; your hosted account data is not.

AI & data boundaries

• The schedule engine is rules-first — deterministic OEM packs and alias matching, not an LLM deciding what is due.
• Import enrichment may call Geoapify location lookup for a shop city/state — you confirm before we save. Location data by Geoapify and OpenStreetMap contributors.
• LLM-assisted extraction for receipts and messy PDFs is rolling out on async paths — documented before fields leave your account.
• Golden-path confirmations still use structured fields you review in the UI — nothing auto-commits without owner action.

Report a concern

Security questions or vulnerability reports: contact@vehicleos.app with subject “VehicleOS security”.

Please do not include live credentials in email.