How we keep your chargers and data safe.
Certified hosting in the EU, TLS on the portal, the app and the API, and role‑based access per location.
The portal, the app and the API only over TLS, the platform in EU data centres
Web portalfor your team
Appfor drivers and owners
Your productREST API, OAuth 2.0
Plugchoice
EU data centresDIN ISO/IEC 27001:2022
Status pagelive uptime
Uptime you can check
Uptime and incidents on our public status page.
- MonitoringWe see the connection status of every charger.
- Automated backupsThe platform database is backed up automatically.
- IncidentsKnown incidents appear on the public status page.
Hosted in the European Union
The platform runs in EU data centre parks of a hosting provider whose Information Security Management System is certified to DIN ISO/IEC 27001:2022 and audited every year by SOCOTEC Certification.
- Every data centre park in the EUThe certificate covers every data centre park the platform runs in.
- Outside the EUProviders that also process data outside the EU are on the subprocessor list, with their location.
- Our subprocessorsEvery provider that processes personal data for us is on the published list. The list of subprocessors
SubprocessorsWhere data is processed
Hosting and storageOur hosting provider, DIN ISO/IEC 27001:2022EU
StripePayments and refundsEU, US
IntercomSupport chat and emailUS
SentryError reportsUS
HologramSIM connectivityUS
You decide who sees and does what
Role-based access per team and per location, managed by the location owner. The web portal
- Access per locationBasic, Sensitive or Full, set by the account holder for every team on every location.
- Two-factor authenticationA time-based code from an authenticator app (TOTP) on top of the password, with recovery codes.
- A role per back officeEach back office gets one role, Billing or Data and control. Data and control can never start or stop a session.
- OAuth 2.0 for your productAccess through the authorization code flow, granted by the owner, without sharing a password.
Your rights to your data
You keep your rights to the data you put into Plugchoice. What we do with data is in our privacy policy.
- Export at any timeThe OCPP message log Plugchoice holds for each charger. Transactions as CSV, Excel or PDF are part of Plugchoice Plus, coming soon.
- Retention and deletionPersonal data is erased 30 days after you delete your account, except what the law requires us to keep and what our privacy policy lets us keep longer. Invoices and billing records stay for 7 years, the Dutch fiscal retention period.
- GDPRPersonal data is processed under the GDPR, with a data processing agreement (Article 28) for business customers.
Security questions for a tender?
We send documentation and answer security questionnaires. To report a vulnerability, follow our responsible disclosure policy.