TeslaFi.com Security

At TeslaFi we take security very seriously and continue to look for opportunities to make improvements. Below is a summary of how TeslaFi obtains and secures the data that it collects.

Hosting

• TeslaFi runs on Amazon's AWS platform and infrastructure. Two factor authentication is required for all access to the AWS account.
• All data is stored in encrypted Amazon RDS databases that are not publicly accessible.
• SSH keys are required to access all servers and IP restrictions further limit access to authorized developers only.

Application Security

• Application servers can be accessed only via HTTPS. Industry standard encryption is used for all data traversing to and from the application servers. View our SSL Labs report.
• All traffic passes through the Cloudflare Web Application Firewall, Rate Limiting and DDoS protection.
• XSS – All user input is encoded when displayed to avoid cross-site scripting vulnerabilities.
• CSRF – All POST requests are checked for a valid CSRF token before the request is processed.
• SQL Injection – Prepared statements are used for database access to avoid SQL injection.

Tesla Account Access

• TeslaFi uses Tesla's official Fleet API. You authorize TeslaFi by signing in on Tesla's own login page, so your Tesla account password is entered only on tesla.com and is never seen or stored by TeslaFi.
• What TeslaFi is allowed to do, including whether it can send commands to your vehicle at all, is set by the permissions you grant in your Tesla account. You can change or revoke them at any time under Third-Party Apps in your Tesla account security settings.

Rivian Account Access

• TeslaFi signs in to Rivian with your Rivian credentials and one-time verification code only to obtain access tokens. Your Rivian password is never stored.
• Only the resulting Rivian access tokens are stored, and they are used solely to retrieve your vehicle data.

TeslaFi.com Account

• Your TeslaFi password is stored only as a one-way hash. It is never kept in plain text, and nobody at TeslaFi can see or recover it.
• TOTP two factor authentication is available for all accounts and can be configured under Settings → Account.
• An email notification can be enabled under Settings → Account to alert you of every new login to your account.
• Repeated failed login attempts temporarily lock the account to prevent password guessing.
• TeslaFi API tokens can be regenerated or revoked at any time from the API page in your account.

Your Data

• You can delete your account and all of its data yourself at any time from Settings.

Credit Card Processing & Billing

• All credit card processing and transactions are conducted within Chargebee. Chargebee is a PCI-DSS Level 1 Service Provider.
• No payment information is stored on or available to TeslaFi.com.
• Chargebee access is protected by two factor authentication.

Reporting A Security Issue

We are working continuously to make our system secure. If you find a security issue, please report it to [email protected] or through our help center.