Security at Nerava

Data Security in Transit and at Rest

• •All connections use HTTPS with TLS 1.2 or higher. Unencrypted HTTP requests are redirected.
• •Data at rest is encrypted using AES-256 via AWS-managed encryption keys.
• •Security headers enforced on all responses: HSTS (max-age 2 years), X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, and XSS protection.
• •Secrets and credentials are stored in AWS Secrets Manager, never in application code or environment files.

Authentication and Authorization

• •Vehicle integrations use OAuth 2.0 through Tesla Fleet API and Smartcar. Nerava never stores vehicle owner passwords.
• •Partner API keys use SHA-256 hashed storage with HMAC verification. Keys can be rotated without downtime.
• •Internal access follows the principle of least privilege. Role-based access controls separate driver, merchant, admin, and partner permissions.

Consent and Data Flow

• •Drivers provide explicit consent before any vehicle data is accessed. Vehicle connections require active OAuth authorization by the vehicle owner.
• •Consent is session-level and revocable. Drivers can disconnect their vehicle or delete their account at any time, which immediately stops all data collection.
• •No passive telemetry collection. Nerava only accesses vehicle data when a driver has an active session or has explicitly connected their vehicle.

Compliance Roadmap

Responsible Disclosure

If you discover a security vulnerability in Nerava, we want to hear about it. Please report it responsibly.