Security
Security and permission infrastructure for EV applications
How Nerava protects vehicle connections, partner data paths, and downstream event delivery. Claims below match current production controls — not a future compliance roadmap presented as done.
Transport and application hardening
- All public connections use HTTPS with X-Content-Type-Options nosniff. The marketing site sets HSTS max-age 63072000 (includeSubDomains; preload) and X-Frame-Options SAMEORIGIN. The API sets HSTS max-age one year (includeSubDomains) and X-Frame-Options DENY.
- Partner API keys are stored as SHA-256 hashes and matched on lookup. Keys can be rotated without changing partner identity.
- Secrets are injected via environment configuration on the production runtime — never committed to source.
Vehicle authorization
- Vehicle integrations use OAuth 2.0 through Tesla Fleet API and Smartcar. Nerava never stores vehicle owner passwords.
- Vehicle access is explicit and revocable. Disconnecting a vehicle or deleting an account stops further collection from that connection.
Downstream permissions
- Smartcar (or OEM OAuth) authorizes vehicle access. Nerava adds a second layer: partner/category scopes for how derived events may be used by business applications.
- Drivers can revoke partner scopes in Consent Center. Disclosure surfaces that depend on required ledger consent fail closed when consent is absent or revoked.
- Partner Portal workspaces enforce membership and role checks. Operator cohort views are additionally gated by configuration and k-anonymity floors where applicable.
Compliance posture
We do not market “GDPR-compliant” or “CCPA-compliant” as completed certifications. Privacy practices are documented in our Privacy Policy; formal attestations are a roadmap item.
| Item | Status |
|---|---|
| SOC 2 Type 1 | Planning |
| SOC 2 Type 2 | Planned |
| Privacy Policy / Terms | Published |
Responsible disclosure
If you discover a security vulnerability in Nerava, please report it responsibly.
Report a vulnerability
Email security@nerava.network with details and reproduction steps when possible. We aim to acknowledge reports promptly.