After we explained why EVStick uses a Virtual Key, the next question naturally came up:
“Okay, but how secure is this access, and what would happen in the event of a potential security incident?”
This deserves a specific answer, not just “we take security very seriously.”
What can EVStick actually do?
EVStick sends only one command to your vehicle — sending coordinates to the navigation through Send to Tesla.
We have no functionality for unlocking the car, opening the trunk, keyless driving, or controlling the climate. That code simply isn’t part of EVStick.
But that alone is not enough to guarantee security.
The honest part
The permission you approve when connecting your Tesla (the “Virtual Key”) technically covers a broader set of capabilities than EVStick actually uses.
This comes from the way Tesla provides vehicle access to third-party applications.
So it would be misleading for us to simply say:
“We don’t have an Unlock button, therefore there is no risk.”
If someone were somehow able to obtain valid access tokens (access_token and refresh_token), they could theoretically attempt to use capabilities permitted by Tesla directly, bypassing EVStick’s functionality altogether.
We knew this when we started building the Tesla integration.
That’s why security wasn’t something we added later. From the very beginning, we approached the integration knowing that we weren’t simply protecting user data — we were protecting access associated with a real vehicle.
Our core principle is:
Even if one part of the system is compromised, that alone should not be enough to obtain working access to the vehicle.
How is access protected in EVStick?
The protection is built in multiple layers.
🔐 Access tokens are stored encrypted
The tokens required to communicate with Tesla — access_token and refresh_token — are not stored in readable form in the database.
They are protected with separate encryption. The encryption key is stored separately from the data itself, with access to it tightly restricted.
This means:
Access to the database alone is not enough to obtain working access to a vehicle.
This separation is a deliberate part of EVStick’s architecture.
👀 We monitor for unusual activity
The system monitors for unusually high volumes of access to sensitive data and automatically raises an alert when such behavior is detected.
The goal is to identify potential anomalies as quickly as possible.
🔑 Access within the system is restricted
Different parts of EVStick’s infrastructure have only the permissions they need to perform their specific tasks.
We follow a simple principle:
Minimum necessary access, rather than access “just in case.”
This helps limit the potential impact if an individual component is ever compromised.
↩️ Data can be restored
We have safeguards against accidental or malicious deletion and corruption of data, including the ability to restore data from up to 7 days in the past.
🚨 We’re prepared for the scenario where something goes wrong
Good security doesn’t mean assuming you’ll never be attacked.
That’s why incident response was considered from the start when designing EVStick’s security.
We have a predefined response plan with specific actions to take — including the ability to quickly revoke access for an affected account.
The goal is to follow a plan that has already been thought through, rather than improvising under pressure.
Security doesn’t end when the product launches
The fact that these measures were built in from the beginning doesn’t mean we consider security “done.”
As EVStick evolves, we periodically review how access is stored, the permissions granted to individual components, our monitoring, and our procedures for responding to potential incidents.
Security is an ongoing process, not a one-time task.
You remain in control
There is another important layer of protection: you control the access.
The connection is authorized by you through Tesla.
EVStick cannot grant itself access to your vehicle.
You can revoke that access at any time directly from your Tesla account, independently of EVStick.
And if you prefer not to connect your vehicle at all, you can still use EVStick. You simply won’t have access to the Send to Tesla feature.
So, how secure is the access?
EVStick has no functionality for unlocking or starting your vehicle. However, the access granted by Tesla technically provides broader capabilities than those EVStick actually uses.
We know this, and that’s exactly why protecting this access has been part of EVStick’s architecture from day one.
We don’t rely solely on the fact that a particular feature doesn’t exist in EVStick.
We protect the access_token and refresh_token themselves, restrict who and what can access them, monitor for anomalies, and maintain a predefined incident response plan.
Zero risk doesn’t exist
No connected system can honestly promise absolute security.
And when a vehicle is involved, we believe being specific about security is far more important than making such promises.
That’s why security has been part of EVStick from day one — and it will continue to evolve alongside the product.
We limit what EVStick does to the minimum necessary. We protect the access through multiple layers. We monitor for potential issues. We’re prepared to respond. And we leave ultimate control over access in your hands.
Because when we ask for access to your vehicle, “just trust us” isn’t a good enough answer.
Have a question about security or the Tesla integration?
Email us at hello@evstick.com.