Just received this reply from VW:
Hello,
Thank you very much for your message.
Please note that the Volkswagen app is only supported on iOS and Android devices running supported operating system versions.
On devices running alternative operating systems (so-called custom ROMs, such as GrapheneOS, LineageOS, or similar solutions), the Volkswagen App may experience limitations or lack certain functionality. These systems are not part of Volkswagen AG’s supported environment for the Volkswagen App, which is why we unfortunately cannot offer technical support for them.
The reason for this is that the Volkswagen App is based on security-critical system components and certified Android standards to ensure reliable and secure use of our digital services.
Of course, we’re happy to assist you with any questions regarding the use of our official apps and services.
If you have further questions about our digital services, please reply directly to this email. You can find additional contact options at https://contact.volkswagen.com. If you call us, please provide your case number 0004541902 so that we can assist you as quickly as possible.
We wish you a safe and enjoyable drive with your Volkswagen at all times.
Best regards,
Your Volkswagen Team
I replied the following to keep the ticket open. Please feel free to use my mail to also contact VW.
Dear Sir or Madam,
Thank you for your reply.
I would like to technically clarify your classification of GrapheneOS as a “custom ROM”. GrapheneOS is not a rooted, manipulated or insecurely modified system, but a security-focused Android operating system based on the Android Open Source Project.
My device is a Google Pixel 10 Pro XL with a locked bootloader, active Verified Boot, no root access and sandboxed Google Play services. The Volkswagen ID works in the browser. The issue occurs exclusively during login in the Volkswagen app.
The fact that GrapheneOS is not Play Protect certified does not mean that the device is insecure. It merely means that GrapheneOS is not part of the traditional Google-certified Android ecosystem.
I therefore kindly ask for technical clarification as to whether login in the Volkswagen app is being rejected due to the Play Protect or Play Integrity status, and whether GrapheneOS is being excluded intentionally or unintentionally as a result.
For the responsible technical department, I would like to refer to the GrapheneOS Attestation Compatibility Guide:
https://grapheneos.org/articles/attestation-compatibility-guide
This guide explains how app providers can verify secure GrapheneOS devices using standardized Android Hardware Attestation, in particular by taking the official GrapheneOS Verified Boot keys into account. This allows the actual device integrity to be assessed, rather than relying solely on formal Google certification.
If Volkswagen intentionally excludes GrapheneOS, I kindly request clear written confirmation of this decision. In my view, such a practice raises questions regarding consumer choice, interoperability, transparency, proportionality and fair access to connected vehicle services.
I therefore kindly ask you to answer the following questions specifically:
- Is GrapheneOS intentionally excluded by the Volkswagen app or backend?
- Is the login rejected due to Play Protect or Play Integrity?
- Will Volkswagen assess support for secure GrapheneOS devices via Android Hardware Attestation?
- Which device integrity data is processed during login?
- Why is only a general connection or reinstallation error displayed?
I kindly ask you to forward this matter to the responsible technical department for app authentication, backend, device integrity verification, data protection and digital compliance.
Thank you for your renewed technical review.