I received a mail from VW:
Thank you very much for your message.
Please note that the Volkswagen app is only supported on iOS and Android devices running supported operating system versions.
On devices running alternative operating systems (so-called custom ROMs, such as GrapheneOS, LineageOS, or similar solutions), the Volkswagen App may experience limitations or lack certain functionality. These systems are not part of Volkswagen AG’s supported environment for the Volkswagen App, which is why we unfortunately cannot offer technical support for them.
The reason for this is that the Volkswagen App is based on security-critical system components and certified Android standards to ensure reliable and secure use of our digital services.
Of course, we’re happy to assist you with any questions regarding the use of our official apps and services.
If you have further questions about our digital services, please reply directly to this email. You can find additional contact options at https://contact.volkswagen.com. If you call us, please provide your case number XXXXX so that we can assist you as quickly as possible.
We wish you a safe and enjoyable drive with your Volkswagen at all times.
Best regards,
Your Volkswagen Team
Feel free to use my reply to them:
Dear Sir or Madam,
Thank you for your response.
I would like to clarify the classification of GrapheneOS as a “custom ROM” from a technical perspective: GrapheneOS is an independently developed, production-ready Android operating system that is based directly on Google’s Android Open Source Project (AOSP) and extends it with additional security and privacy features. It is not a rooted, modified, or insecurely configured system.
My Google Pixel 10 Pro XL has:
a locked bootloader,
Verified Boot,
hardware-backed device attestation,
no root access,
the official, unmodified Google Play Services installed in the sandbox provided by GrapheneOS.
I respect that Volkswagen may formally limit support to certain operating systems. However, the general classification as an unsupported operating system does not fully explain the specific issue:
The Volkswagen app worked on the same device and under the same system environment until the most recent update. Since then, the app demonstrably calls the Google Play Integrity API during login and immediately afterwards terminates the process with a general connection error message. The Volkswagen ID works in the browser.
This indicates a change in the Play Integrity evaluation, app authentication, or the Volkswagen backend. I therefore kindly ask that the case not be closed merely with reference to a “custom ROM”, but instead be forwarded as a technical compatibility regression to the responsible team for app authentication, backend, and device security.
Please check in particular:
whether the required Play Integrity verdicts have recently been changed;
whether GrapheneOS has since been intentionally or unintentionally excluded;
whether this is a documented support decision or a technical side effect;
whether standardized Android hardware attestation with the official GrapheneOS signing keys could alternatively be supported.
GrapheneOS provides a technical “Attestation Compatibility Guide” for app developers in this regard. Please see: Attestation Compatibility Guide | Articles | GrapheneOS.
Should Volkswagen deliberately no longer allow GrapheneOS, I kindly request clear written confirmation of this decision. Otherwise, I kindly ask that the case be forwarded and reviewed as a possible issue with the current app or backend version.
Thank you for your renewed technical review.