Enterprise-grade security for EV charging operations
We protect your charging network with ISO 27001 and SOC 2 Type 2 certifications, AWS infrastructure, AES-256 encryption, 24/7 monitoring, and comprehensive audit trails. From secure OCPP connections to GDPR compliance, your charging operations stay protected.
Trusted by 1000+ operators around the world
Certified security infrastructure
EV charging infrastructure faces specific security challenges, from DDoS attacks that take systems offline to payment fraud and unauthorized access. Monta’s security infrastructure is designed to detect and block these threats before they impact operations.
Network infrastructure runs on AWS with multi-datacenter distribution and private network isolation. Application security comes from regular code audits, automated vulnerability scanning, and penetration testing by independent firms. Data security uses encryption, tokenization of payment information, and strict access controls.
24/7 monitoring with Grafana dashboards and on-call escalation, with incident response procedures that ensure rapid containment when issues arise. Every security event is logged and analyzed to strengthen defenses.
Security standards
Monta maintains independently audited certifications and meets enterprise regulatory compliance standards.
- ISO/IEC
- 27001 Certified
- Information security management system certified since 2023 by DNV, audited annually. Covers data confidentiality, access controls, and risk management processes.
- SOC 2®
- Type 2 Certified
- Independent attestation that security, availability, and confidentiality controls operate effectively over time.
- NIS2
- Aligned
- Meets the EU NIS2 Directive's requirements for cybersecurity and operational resilience.
- PCI DSS
- Compliant
- Zero card data storage. All transactions flow through PCI-certified processors (Stripe, Adyen, Payter) with tokenization.
Information security governance
A dedicated Information Security Board oversees security strategy, reviews audit results, evaluates vendor risks, and ensures compliance with certification requirements. Regular risk assessments identify threats and prioritize security improvements.
Multi-layer security architecture
Every layer is documented in technical detail and available for review during due diligence.
Encryption and key management
TLS 1.2+ for all communications with automated certificate rotation every 8 months. AES-256 for data at rest with AWS KMS managing keys. Private network isolation so databases never touch the internet.
Infrastructure resilience
Multi-datacenter distribution across Europe with RTO under one hour and RPO 24 hours. Disaster recovery tested twice yearly with documented results. Single datacenter failure causes zero data loss.
Monitoring and incident response
24/7 monitoring with Grafana dashboards and on-call escalation. Tamper-protected audit logs capture every privileged action. Public status page and documented incident response plan.
Payment and compliance
Zero card data storage. All transactions flow through PCI-certified processors (Stripe, Adyen, Payter) with tokenization. PCI compliance boundary is clear and documented.
Vulnerability management
Annual independent penetration testing via Cobalt. Continuous automated vulnerability scanning. Risk-based SLA for remediation before issues reach production.
Access control and audit
Least-privilege access with role-based permissions. MFA and SSO enforcement for administrative access. Tamper-protected logs with synchronized timestamps capture privileged actions for forensic investigation.
Security without compromise
The most secure global cloud infrastructure
Amazon Web Services
Data is stored and processed on AWS with AES-256 encryption at rest via AWS KMS and TLS 1.2+ in transit. Encryption keys are managed separately from encrypted data. Private keys secured to SRE team only. Staging and production environments run in isolation with separate access controls to prevent configuration errors from affecting live systems.
Secure coding standards
Development follows security best practices and secure coding standards. Code is tested for common vulnerabilities (SQL injection, XSS, and authentication flaws) before deployment. Security requirements are defined during feature planning, not added retroactively.
Secure development practices
Code is tested for common vulnerabilities before deployment. Security requirements are defined during feature planning, not added retroactively.
Is your EV charging business NIS2-ready?
Get the essential guide to the EU NIS2 Directive, industry security challenges, and the practices that keep your data and infrastructure protected.
Our dedicated Governance, Risk and Compliance Committee, headed by board member Adrienne Gormley, oversees and guides our approach, enabling effective decision-making and adaptability. By anticipating challenges, swiftly responding to threats, and seizing growth opportunities, we navigate confidently and empower sustainable success.
Staying one step ahead of threats
- Penetration testing
- Regular, rigorous penetration testing simulates real-world hacking attempts to uncover potential weaknesses before they can be exploited.
- Partnership with Cobalt
- We collaborate with trusted security partner Cobalt, whose skilled team conducts comprehensive tests across our products and systems to identify vulnerabilities.
- Real-world attack simulation
- Cobalt's experts replicate a wide range of attack scenarios and techniques, meticulously uncovering potential entry points and vulnerabilities in our defences.
- Continuous improvement
- Insights from each assessment feed directly into stronger security measures, helping us stay ahead of emerging threats and safeguard your data with confidence.
Minimize business impact with our disaster recovery plan
Monta is prepared for unforeseen incidents with robust disaster recovery and business continuity plans. Our databases are hosted in a secure private network with encryption-at-rest, providing an additional layer of protection.
In the event of a disaster, infrastructure can be rapidly deployed in a different geographic region with RTO under one hour. This proactive approach ensures uninterrupted operations, even in catastrophic scenarios. We regularly test and validate our procedures to maintain the effectiveness of our disaster recovery strategy.
FAQs
Which security certifications does Monta hold?
Monta holds two independently audited certifications: ISO 27001 (certified since 2023, audited annually by DNV) and SOC 2 Type 2. Both certifications are production-active and available for technical review during evaluation. In addition to these certifications, Monta maintains compliance with PCI DSS and GDPR. All security documentation: certification reports, compliance assessments, disaster recovery tests, and penetration testing reports – are available during evaluation, not after contract signature. You can read more on security at Monta on our Help Center page and in our Information Security Policy.
How often is penetration testing performed?
Annual independent penetration testing via Cobalt, plus continuous automated vulnerability scanning across infrastructure and runtime. Vulnerabilities are remediated on a risk-based SLA before reaching production.
Where is data stored and how is it protected?
Primary region is Ireland with multi-datacenter distribution across Europe. All data at rest is encrypted with AES-256 via AWS KMS. Databases run on private networks with no internet access.
What is the disaster recovery process?
RTO under one hour, RPO 24 hours. Full disaster recovery tests performed twice yearly with documented results. Multi-datacenter distribution means a single facility failure causes zero data loss.
How is OCPP communication secured?
All charge point communications use TLS 1.2+ minimum with automated certificate rotation every 8 months. Certificates are managed via AWS Managed Certificates and Let’s Encrypt. Private keys are secured to the SRE team only.
How does Monta handle payment security?
Monta stores zero card data. All transactions flow through PCI-certified processors (Stripe, Adyen, Payter) with tokenization. The PCI compliance boundary is clear and documented.
What monitoring is in place for security incidents?
24/7 monitoring with Grafana dashboards and on-call escalation integrated into collaboration tools. Tamper-protected centralized logging captures privileged actions with synchronized timestamps for forensic investigation. Public status page at status.monta.app.
Can we review security documentation before signing?
Yes. All certifications, penetration test results, incident response plans, and disaster recovery test logs are available for technical review during evaluation, not after contract signature.
Ready to scale with confidence?
See how Monta’s enterprise-grade security keeps your EV charging business safe, compliant, and always-on.