Skip to content
Start testing
Security and deployment

Security and deployment for OCPP and OCPI testing

How OCPPLab handles access, tenant isolation, encryption in transit, log retention, and deletion — and what to raise with us before a deeper security review.
Tenant isolation and transportThe browser reaches the OCPPLab app and APIs over HTTPS. Org A and Org B each hold their own locations and tokens, logs and virtual chargers, separated by database row-level security. Logs are kept 7 days on Starter and 30 days on Pro. A virtual charger connects to your CSMS with OCPP security profile 1, 2 or 3; profile 3 is TLS with a client certificate.BrowserHTTPSOCPPLab app and APIsRow-level securityOrg AStarterLocations and tokensLogsKept 7 daysVirtual chargersOrg BProLocations and tokensLogsKept 30 daysVirtual chargersOCPP security profile 1–3Your CSMSProfile 1Basic authentication, no TLSProfile 2TLS + Basic authenticationProfile 3TLS + client certificate (mTLS)
Tenant isolation and transportThe browser reaches the OCPPLab app and APIs over HTTPS. Org A and Org B each hold their own locations and tokens, logs and virtual chargers, separated by database row-level security. Logs are kept 7 days on Starter and 30 days on Pro. A virtual charger connects to your CSMS with OCPP security profile 1, 2 or 3; profile 3 is TLS with a client certificate.BrowserHTTPSOCPPLab app and APIsOrg AStarterLocations and tokensLogsKept 7 daysVirtual chargersRow-level securityOrg BProLocations and tokensLogsKept 30 daysVirtual chargersOCPP security profile 1–3Your CSMSProfile 1Basic authentication, no TLSProfile 2TLS + Basic authenticationProfile 3TLS + client certificate (mTLS)

OCPPLab is a hosted cloud service. Every workspace belongs to one organization, and the facts below describe how the product handles that data today. Enterprise teams can raise anything not covered here, including private hosting or a specific region, in a scoped conversation before procurement.

Deployment models

Hosted cloud

OCPPLab runs as a hosted service. Teams sign up, connect a CSMS or roaming partner, and start testing without installing anything or procuring hardware.

Enterprise conversation

If internal policy requires tighter network control, private hosting or a specific region, raise it with us on the Enterprise plan. It is scoped per customer, not a self-serve option.

Data handling

Tenant isolation
  • Every workspace record is scoped to one organization.
  • Database row-level security limits each signed-in member to rows of their own organization.
  • Members only see the organizations they were invited to.
Encryption and access
  • The web app and APIs are served over HTTPS (TLS).
  • Virtual chargers support OCPP security profiles, including TLS with client certificates, when your CSMS requires them.
  • Organization owners and admins manage members and roles.
Retention and deletion
  • Logs are kept for 7 days on Starter and 30 days on Pro; Enterprise retention is agreed per customer.
  • Chargers, locations, tokens, and other workspace records can be deleted from the product at any time.
  • You can delete your account from account settings, or contact us to request deletion of other data.
Starter
7 days
Pro
30 days
Enterprise
Custom

Report a vulnerability

If you find a security issue in OCPPLab, email it to us. This is the contact published in our security.txt file. security@ocpplab.com

  1. What to send

    The affected URL, API, or component, the steps to reproduce, the impact you observed, and a way to reach you for follow-up questions.

  2. Scope

    Services OCPPLab operates: this website, the OCPPLab app, its public APIs, and the OCPPLab SDK. Third-party services we link to are out of scope; report those to their owners.

  3. How to test

    Use only accounts and data you own. Do not access, change, or delete other people's data, do not run denial-of-service or social-engineering tests, and stop once you have confirmed the issue. Keep details private until we have fixed it or agreed a date with you.

Before a security review

Know your protocol scope
OCPPLab covers OCPP 1.6 / 2.0.1 / 2.1 and OCPI 2.1.1 / 2.2.1 / 2.3.0. Aligning on scope first keeps the review focused on the traffic you will actually send.
Check plan limits
Log retention, OCPI requests and storage differ by plan; the pricing page lists them, so you can match retention to your policy.
Ask us directly
For questionnaires, sub-processors, or deployment requirements, contact us. We answer with what the product does today.