Security and limits
Awareness software, not a security SLA.
GuestLot tells you what a customer’s Tesla did while it was in your care. It does not stop anyone from driving it, and it cannot undo access that Tesla itself does not let us take back. Every limit below is a limit of the platform or a decision we made on purpose, and we would rather you read them now than discover them during a dispute.
Tesla Fleet API limits
What the platform genuinely cannot do.
These are not roadmap items. They are properties of Tesla's API, and any vendor telling you otherwise is selling a story the car will not back up.
- There is no command. Service Mode is entered on the car’s own touchscreen by a person standing at the vehicle. What GuestLot can do is read the telemetry signal and alert you if the car leaves Service Mode mid-repair. See Valet Mode vs Service Mode.
- An NFC key card is full drive access with no audit trail. It cannot be remote-wiped — not by us, not by the owner from their phone. Removing it requires the car and another key. If a card walks out of your shop, software is not the remedy. Details in the Tesla key card at the shop.
- Valet Mode locks the frunk and glovebox, caps speed at 70 mph, and hides the owner’s profiles and key list. It is the wrong default for PPF, wrap, and collision work, where the frunk has to open. It has no effect on Service Mode. We leave it off for those jobs and say why.
- Fleet Telemetry streams only while the vehicle is paired and the owner’s authorization is live. Cars asleep, out of signal, or never paired report nothing, and the record says instead of showing a zero.
- An owner can revoke GuestLot at any moment from their Tesla account. That is their right and we do not warn you first. Revocation ends the lot watch immediately; the record up to that second stands.
By design
Things we refuse to build.
Each of these has been requested. Each one would make the product easier to sell to a shop and impossible to justify to the owner whose car it is.
- No live GPS map. Not for staff, not for the GM, not for the owner. The lot watch reports whether the car is inside one of your configured fences — lot, overflow, and on collision tickets a road-test route — or outside all of them, with timestamps. That is the whole geography. We never publish a position.
- No staff tracking. GuestLot watches customer vehicles inside a consented window, not employees. There is no route history, no driver score, no idle report.
- No editing a closed snapshot. Once a hand-back closes the record, nobody can amend it — not your GM, not our support team. An editable record is worth nothing to an insurer.
- No selling or brokering vehicle data. Owner data belongs to the visit it came from. We do not sell it, syndicate it, or train anything on it.
- No fabricated readings. If Tesla did not send a value, we print . A confident zero is a lie with better formatting.
What we do
The parts that are ours to get right.
- Access is a window with two ends. It starts when the owner authorizes and ends at the pickup time on the ticket, whether or not anyone remembers to close it.
- Hand-back revokes shop access with Tesla in the same tap that closes the snapshot.
- The AccessReceipt is a tokenized link, not a login. Owners never create an account and never install anything, so there is no owner password for anyone to lose.
- Guest Mode is on by default for shop jobs, which means the shop cannot add keys or change PINs on the customer’s car.
- Alerts go to a named person, and hand-backs carry the advisor’s name. Anonymous actions do not settle arguments.
Data handling
How consent, storage, and revocation actually work.
Consent. Nothing is read until the owner authorizes GuestLot through Tesla’s own third-party app screen. The window is bounded by the pickup time on the ticket. Pre-authorized visits sit armed and dormant — zero reads — until the car reaches your lot.
Scope. We request what the custody record needs and nothing decorative. What each scope grants, in plain language, is in give a shop access to your Tesla.
Storage. The visit record is the product: check-in snapshot, event log, closed snapshot, receipt. It is retained so the receipt keeps working, including after a shop cancels, because it documents something that already happened.
Revocation. Three ways it ends: the advisor taps hand back, the pickup time arrives, or the owner revokes from the Tesla account under Security, Third-Party Apps — or at the car. All three are logged with a timestamp and all three appear on the receipt.
The full legal versions live in privacy and terms. This page is the honest summary, and where the two disagree, assume this page is the plainer one and the legal text is the binding one.
- Advisor taps hand back
- Pickup time arrives
- Owner revokes in Tesla account
Why the limits matter commercially
An honest record is the only kind worth having.
A shop holding a customer’s car is a bailee, and when something goes wrong it is the shop that has to show what happened. A record that could be edited, or that printed a comfortable zero where data was missing, would collapse the first time anyone leaned on it. That is why the limits on this page are features. Read garage keepers liability for what carriers ask for, and customer car damaged at a shop for what happens when a claim starts.
None of this is legal advice, and GuestLot does not prevent theft, damage, or misuse. It documents a window of custody accurately enough that both sides can stop guessing.
Keep reading
Tesla Fleet API for shops
What the API returns, what it refuses, and why it matters at the counter.
The key card at the shop
Full drive access, no audit trail, no remote wipe.
Valet vs Service Mode
Which mode belongs on which job, and what each one blocks.
For Tesla owners
The same limits, written for the person who owns the car.
Glossary
Consent window, virtual key, Guest Mode, defined.
Pricing
$179 or $349 per location. Read the limits first anyway.
Buy it for what it does.
If the limits above are dealbreakers, we would rather you know today. If they read like honesty, the trial is fourteen days and does not ask for a card.