CarChargeOS is the software of record behind charging networks that businesses depend on - so security isn't a feature we bolt on, it's a property of how the platform is built and operated. This page summarizes the practices behind the six pillars described on the platform security overview: encryption, identity and access, auditability, availability, observability, and data protection.
Infrastructure and hosting
The managed cloud offering runs on established public cloud infrastructure across multiple regions, with in-country data residency available where regulation or customer policy requires it. Enterprise deployments can also run inside a customer's own cloud account or on an air-gapped on-premise environment - the same product and release cadence in every deployment model. See the enterprise deployment options for details.
Encryption
Traffic to and from the platform - operator dashboards, driver-facing apps, and OCPP connections from charging stations - is encrypted in transit. Supported data stores encrypt data at rest. Secrets and credentials are managed separately from application data rather than embedded in configuration or code.
Identity and access control
Access to the platform is governed by role-based permissions, so operator staff see and can act on only what their role requires. Enterprise customers can integrate their own identity provider over SAML or OIDC for single sign-on, centralized provisioning, and de-provisioning. Internally, engineering and support access to production systems follows least-privilege principles and is reviewed on an ongoing basis.
Multi-tenant isolation
Where a deployment serves more than one brand, property, or franchise on shared infrastructure, tenants are logically isolated at the data and configuration layer, so one tenant's data, branding, and settings are never visible to another.
Auditability
Administrative and operational actions - configuration changes, remote commands to a charger, tariff edits, user and role changes - are logged at the request level. Audit logs are filterable and exportable on demand, so operators and their security or compliance teams can reconstruct who did what, and when.
Availability and resilience
Platform services run redundantly with automated failure recovery, and charging sessions are designed to continue operating even during a temporary loss of connectivity to the back office, so a driver already plugged in isn't stranded mid-session. Data is backed up on a regular schedule with tested recovery procedures.
Monitoring and observability
The platform is monitored end to end - application health, infrastructure metrics, and the connectivity and status of every charging station - with alerting so operational issues, whether in our infrastructure or on a charger in the field, are surfaced quickly rather than discovered by a driver.
Secure development practices
Code changes go through review before release, dependencies are tracked and kept current, and releases roll out in stages rather than all at once, so a regression is caught and contained before it reaches every customer.
Standards and compliance alignment
CarChargeOS supports OCPP 1.6J, 2.0.1, 2.0.1 Ed3, and 2.1 for charger communication and OCPI 2.2.1 for roaming, and the practices above are aligned with ISO 27001. Specific certifications, attestations, and reports vary by deployment and are available to enterprise customers under NDA - reach out via contact and our team will share what applies to your evaluation.
Shared responsibility
Security on a charging network is shared between the platform and the physical layer it doesn't control: the charger hardware, the site's network, and how an operator configures roles and access for its own staff. We secure everything within the platform and give operators the controls - role-based access, SSO, audit logs - to secure their side of that boundary.
Reporting a security issue
If you believe you've found a security vulnerability in CarChargeOS, please report it to security@carchargeos.com. Include enough detail to reproduce the issue and we'll acknowledge and investigate promptly. Please give us a reasonable opportunity to investigate and address a report before disclosing it publicly.