Connected Vehicle Security for Dealerships: 7 Questions to Ask Your Technology Provider

Dealerships use connected technology to locate inventory, check vehicle readiness, protect vehicles from theft, support recovery and stay connected with customers after the sale. 

Once that hardware is installed across inventory, dealership leadership should understand what it can access and what it is allowed to do. 

For a Dealer Principal or GM, the questions are practical. What does the device connect to? What vehicle information can it read? Can it send commands back to the vehicle? Who can access the information? What changes after delivery? 

Recent research into dealer-installed connected vehicle systems has put more attention on those questions. The communication method alone, whether Bluetooth, cellular or wired, does not tell a dealer enough about the security of a product. 

The full architecture matters: how the device communicates, what it can read or control, who can access the information and how that access is protected. 

Here are seven questions worth asking any connected-vehicle provider. 

Start With Vehicle Visibility vs. Vehicle Control 

One distinction helps make the rest of the conversation easier: reading information from a vehicle is different from having authority to control vehicle functions. 

Vehicle visibility can support everyday dealership work. 

Vehicle control involves a different level of access. Depending on the system, commands could include locking or unlocking doors, affecting ignition, immobilizing the vehicle, activating an alarm, operating lights or sounding the horn. 

That difference matters more than whether the underlying connection is wired, Bluetooth or cellular. 

Recent UC San Diego research into aftermarket Bluetooth vehicle systems illustrates the point. Researchers found meaningful differences among the systems they studied, particularly in authentication and the vehicle functions each system could control. 

Two products can use the same general connection method and still have very different security profiles. 

For a deeper look at the specific KARR findings and the Bluetooth control path involved, read The KARR Bluetooth Vulnerability: What Dealers Should Know About Connected-Vehicle Architecture. 

7 Questions Every Dealer Should Ask a Connected-Vehicle Provider

1. How Does the Installed Device Communicate?

The provider should be able to explain the connection path in plain English. 

Does a customer’s phone communicate directly with the installed hardware? Does the device use Bluetooth or cellular? Does communication go through the provider’s platform before reaching an app? 

Dealership leadership does not need a network diagram, but it should understand the route between the vehicle, the provider and the user. 

If a phone can communicate directly with installed hardware, for example, the next questions are how that phone is authenticated and what it is allowed to do once connected. 

The goal is to understand where the connection leads and what permissions sit behind it.

2. What Can the Device Read From the Vehicle?

“Vehicle data” is too broad an answer. 

Depending on the product and vehicle, a system may receive location, mileage, diagnostic trouble codes, battery information, fuel level or vehicle identification information. 

Each type of information should have a clear purpose. 

Location can help staff find a unit on the lot. Battery information can identify a readiness issue before a customer arrives for a demo drive. Mileage and diagnostic information can support future service communication. 

CarRx uses vehicle information to support dealership workflows including lot management, inventory readiness and customer service needs. 

Once a dealer understands what the system can read, the next question is whether it can also act on the vehicle.

3. Can the Device Send Commands to the Vehicle?

Dealers should get a direct answer to this one. 

Can the system unlock a door? Affect ignition? Disable a vehicle? Sound the horn? Operate lights or activate the alarm? 

Those permissions deserve a different level of scrutiny from information used to locate a vehicle or check its battery. 

The recent KARR disclosure provides an example. CISA’s advisory described a vulnerability in affected products that could allow unauthorized vehicle-control operations, including door unlocking and engine immobilization. 

CarRx’s CAN bus communication is limited to read-only requests and responses for vehicle data. It does not send commands that lock or unlock doors, affect ignition, disable a vehicle, activate alarms, operate lights or sound the horn. 

CarRx is designed around vehicle visibility. That gives dealership teams information they can use to locate inventory and monitor vehicle readiness without giving the system authority to operate those vehicle functions.

4. How Are Users and Devices Authenticated?

A GM does not need to compare encryption standards. The provider should still be able to explain how access is granted and removed. 

Do employees receive unique credentials? What happens when a new employee or device is added? Can access be shut off when someone leaves the dealership? 

The same applies to devices. What prevents an unauthorized phone or other device from being treated as trusted? 

Authentication was an important part of the UC San Diego findings, including differences in how the systems researchers examined handled access. 

The dealer should be able to get a clear answer to one basic question: How does the system verify that the person or device connecting to it should have access?

5. Who Can See Vehicle Location and Other Information?

Dealership leadership should know who inside the store can access connected-vehicle information, whether permissions vary by employee role and whether outside parties have access. 

Location deserves extra attention because the answer may change once the vehicle is sold. 

Using location to find a unit in dealership inventory is very different from giving a dealership access to a customer’s location after delivery. 

In January 2026, the Federal Trade Commission finalized an order involving GM and OnStar over allegations involving the collection, use and sale of precise geolocation and driving-behavior data without adequate consumer disclosure and consent. 

For a dealer, the practical issue is access: who can see what information, and for how long?

6. What Happens to Access After the Vehicle Is Sold?

A provider should explain the handoff from dealership inventory to customer ownership before hardware is installed across the lot. 

With CarRx, the dealership can use vehicle information to support inventory management before the sale. 

After the vehicle is sold and registered to its new owner, vehicle location is private to that registered owner. The dealership does not have access to the customer’s location. 

If a customer activates CarRx, they can choose to share certain vehicle-health information with the dealership, including mileage and diagnostic trouble codes. That information can help support future service needs. 

Customer location is not included. 

This allows the dealership to stay connected to information that can support the service relationship without seeing where the customer drives. 

Customers looking for more information about post-sale access and privacy can visit the CarRx Driver FAQ.

7. What Happens When a Security Problem Is Found?

The useful question is what happens when a vulnerability is discovered. 

How can researchers or customers report a concern? How does the provider investigate it? How are devices already installed in the field updated? Can an update be pushed remotely, or does the dealership need to bring vehicles back? 

That last question matters when hardware is installed in hundreds of vehicles or across multiple rooftops. 

The dealership should know how a fix moves from the provider’s engineering team to devices already sitting on the lot or installed in customer vehicles. 

Independent security review can also be part of that due diligence. 

CarRx has undergone a SOC 2 Type I examination. It should be described as an examination, rather than a certification. 

How CarRx Answers These Questions 

A provider installing connected hardware across dealership inventory should be able to give specific answers about architecture, permissions and post-sale access. 

Here is the CarRx approach: 

One technical choice does not prove a connected product is secure. Dealers should look at the full picture: communication path, vehicle permissions, authentication, data access, post-sale privacy and the provider’s process for handling security issues. 

Make Security Part of the Vendor Review 

Dealer Principals and GMs already ask practical questions before putting new technology across a store. 

What does it cost? How difficult is installation? What does training involve? Will the team use it? What happens when something goes wrong? 

Connected-vehicle technology deserves a few more. 

If hardware is going into hundreds or thousands of vehicles, dealership leadership should know what it connects to, what information it can access, whether it can control vehicle functions and who maintains access after delivery. 

The GM does not need to audit source code. The provider does need to explain the system clearly enough for dealership leadership to understand what is being installed across its inventory. 

Use these seven questions during the next vendor review. 

Download: What Dealers Should Know About Connected-Vehicle Security

Want to understand how CarRx handles connected vehicle security, vehicle information and post-sale privacy? 

Talk with CarRx.