Enterprise-grade security for EV charging operations
We protect your charging network with ISO 27001 and SOC 2 Type 2 certifications, AWS infrastructure, AES-256 encryption, 24/7 monitoring, and comprehensive audit trails. From secure OCPP connections to GDPR compliance, your charging operations stay protected.
Certified security infrastructure
EV charging infrastructure faces specific security challenges, from DDoS attacks that take systems offline to payment fraud and unauthorized access. Monta’s security infrastructure is designed to detect and block these threats before they impact operations.
Network infrastructure runs on AWS with multi-datacenter distribution and private network isolation. Application security comes from regular code audits, automated vulnerability scanning, and penetration testing by independent firms. Data security uses encryption, tokenization of payment information, and strict access controls.
24/7 monitoring with Grafana dashboards and on-call escalation, with incident response procedures that ensure rapid containment when issues arise. Every security event is logged and analyzed to strengthen defenses.
Information security governance
A dedicated Information Security Board oversees security strategy, reviews audit results, evaluates vendor risks, and ensures compliance with certification requirements. Regular risk assessments identify threats and prioritize security improvements.
Multi-layer security architecture
Every layer is documented in technical detail and available for review during due diligence.
Encryption and key management
Infrastructure resilience
Multi-datacenter distribution across Europe with RTO under one hour and RPO 24 hours. Disaster recovery tested twice yearly with documented results. Single datacenter failure causes zero data loss.
Monitoring and incident response
24/7 monitoring with Grafana dashboards and on-call escalation. Tamper-protected audit logs capture every privileged action. Public status page and documented incident response plan.
Payment and compliance
Zero card data storage. All transactions flow through PCI-certified processors (Stripe, Adyen, Payter) with tokenization. PCI compliance boundary is clear and documented.
Vulnerability management
Access control and audit
Least-privilege access with role-based permissions. MFA and SSO enforcement for administrative access. Tamper-protected logs with synchronized timestamps capture privileged actions for forensic investigation.
Security without compromise
The most secure global cloud infrastructure
Amazon Web Services
Data is stored and processed on AWS with AES-256 encryption at rest via AWS KMS and TLS 1.2+ in transit. Encryption keys are managed separately from encrypted data. Private keys secured to SRE team only. Staging and production environments run in isolation with separate access controls to prevent configuration errors from affecting live systems.
Secure coding standards
Development follows security best practices and secure coding standards. Code is tested for common vulnerabilities (SQL injection, XSS, and authentication flaws) before deployment. Security requirements are defined during feature planning, not added retroactively.
Secure development practices
Code is tested for common vulnerabilities before deployment. Security requirements are defined during feature planning, not added retroactively.
Is your EV charging business NIS2-ready?
Get the essential guide to the EU NIS2 Directive, industry security challenges, and the practices that keep your data and infrastructure protected.
Staying one step ahead of threats
Minimize businesses impact with our disaster recovery plan
Monta is prepared for unforeseen incidents with robust disaster recovery and business continuity plans. Our databases are hosted in a secure private network with encryption-at-rest, providing an additional layer of protection.
In the event of a disaster, infrastructure can be rapidly deployed in a different geographic region with RTO under one hour. This proactive approach ensures uninterrupted operations, even in catastrophic scenarios. We regularly test and validate our procedures to maintain the effectiveness of our disaster recovery strategy.
FAQs
Monta holds two independently audited certifications: ISO 27001 (certified since 2023, audited annually by DNV) and SOC 2 Type 2. Both certifications are production-active and available for technical review during evaluation.
In addition to these certifications, Monta maintains compliance with PCI DSS and GDPR. All security documentation: certification reports,
compliance assessments, disaster recovery tests, and penetration testing reports – are available during evaluation, not after contract
signature.
You can read more on security at Monta on our Help Center page and in our Information Security Policy.
Annual independent penetration testing via Cobalt, plus continuous automated vulnerability scanning across infrastructure and runtime. Vulnerabilities are remediated on a risk-based SLA before reaching production.
Primary region is Ireland with multi-datacenter distribution across Europe. All data at rest is encrypted with AES-256 via AWS KMS. Databases run on private networks with no internet access.
RTO under one hour, RPO 24 hours. Full disaster recovery tests performed twice yearly with documented results. Multi-datacenter distribution means a single facility failure causes zero data loss.
All charge point communications use TLS 1.2+ minimum with automated certificate rotation every 8 months. Certificates are managed via AWS Managed Certificates and Let’s Encrypt. Private keys are secured to the SRE team only.
Monta stores zero card data. All transactions flow through PCI-certified processors (Stripe, Adyen, Payter) with tokenization. The PCI compliance boundary is clear and documented.
24/7 monitoring with Grafana dashboards and on-call escalation integrated into collaboration tools. Tamper-protected centralized logging captures privileged actions with synchronized timestamps for forensic investigation. Public status page at status.monta.app.
Yes. All certifications, penetration test results, incident response plans, and disaster recovery test logs are available for technical review during evaluation, not after contract signature.
Ready to scale with confidence?
See how Monta’s enterprise-grade security keeps your EV charging business safe, compliant, and always-on.