What VehIQ publishes, and how to report a problem

VehIQ publishes the following parts of a vehicle's record, where it holds data for them. A part without data for a vehicle says so on the page; it is not filled in. The public API serves the same list.

Identity and registration

• Identity and basic facts
• Mileage
• Specifications
• Registration status
• Registration timeline

Register records

• Register facts (Netherlands)
• Inspection
• Recalls

Observed facts

• Observed vehicle facts (Sweden)
• Ownership history (aggregates)
• Marketplace ads linked to the vehicle

Market

• Comparable ads
• Price history
• Current asking price
• Position in the observed price spread
• How many similar vehicles

Estimates

• Value estimate
• Market models for asking price and time to delisting
• Model-typical estimates

Photos and equipment

• Photos
• Equipment

Every vehicle page has a panel, “What does VehIQ know about this vehicle?”, that lists these parts for that vehicle with their source and the date of the data.

These kinds of information are left out of every vehicle page and every API answer. This says what is not shown. It is not a statement about what is stored.

• Who owns the vehicle
• The type of owner
• Contact details of any person
• The chassis number (VIN)
• Financial interests in the vehicle
• Who sells the vehicle in an ad
• Saved copies of other websites' pages

The profile in force is conservative-published-fields. It is the list in section 1 and nothing else: the parts the public vehicle page serves today. A part is added only by a reviewed change to that list.

Which fields could be shown for which type of vehicle owner, and in which market, has not been decided. Until it is, nothing beyond the list is published.

The address of a vehicle page, and the vehicle ID in it (it starts with pv1_), is not an anonymous code. It is a reversible encoding of the market and the registration number, and anyone can decode it.

These addresses are listed in the Swedish and Dutch sitemaps and appear in API answers: in search results and in the sample vehicles on make and model pages. So the registration number of a vehicle can be derived from the address of its page.

Changing to identifiers that carry no registration number is a pending decision. No date is promised.

You can ask for the page of a vehicle to be removed, or for a correction, with the report form. Coming from the vehicle page, the form arrives filled in with that vehicle.

What happens to a request

• A person at VehIQ reads the request and decides. Nothing is automatic.
• No answer time is promised, and a request does not always lead to a change.
• VehIQ holds no owner identity, so it cannot check who is asking. The decision is made on the information in the request.
• Until a decision has been made, the page is unchanged.

If the decision is to remove the page

• The vehicle page answers “not found” (HTTP 404) and the vehicle is taken out of the sitemap feed.
• For a Dutch registration number, the Dutch history tables that are keyed on that number are also erased.
• The copy of the register data that VehIQ holds, backups and logs are not erased.

A request about personal data under data protection law belongs with our privacy contact: privacy@vehiq.app.

• Data sources: which sources VehIQ draws on, under which licence, and when each was last refreshed.
• Report a data error: tell VehIQ that a figure is wrong, ask for a correction, or ask for a page to be removed.

If you find a security problem, write to security@vehiq.app. The address is also published, in machine-readable form, in security.txt.

Please include

• what the problem is and what it could be used for
• the steps to reproduce it, or a proof of concept
• the address or endpoint where you found it
• logs or screenshots, if you have them
• whether you want to be credited, and how

Please send the report by e-mail and not as a public issue.

The public surface of vehiq.app, api.vehiq.app.

Not in scope

• denial-of-service testing
• social engineering
• data of other tenants or of real people: do not access it, and test only with your own data

There is no bug bounty.

VehIQ reads and triages the reports it receives.

If you wish, you are credited once the problem is fixed.

No response time is promised. VehIQ has not set a service level for security reports.