Snapshot 190216
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center
Start your security review
View & download sensitive information
Overview
Welcome to ChargePoint's Trust Center.
At ChargePoint, we’re committed to security of all of our customers data, and service. We know people rely on us for the most convenient, dependable and safest electric vehicle (EV) charging experience possible. That’s why, since 2007, we’ve been passionate about developing the tools and technologies to promote the widespread adoption of EVs and the availability of EV charging, while also protecting grid reliability and resiliency. Today, we continue to work with national, federal, state and local agencies around the globe to proactively ensure our security standards are among the most comprehensive in the industry.
Use this Trust Center to learn about our security posture and request access to our security documentation.
Visit https://www.chargepoint.com/solutions/customer-stories for customer stories.
Compliance
FedRAMP LI-SaaS
ISO 14001:2015
ISO 45001:2018
ISO 9001:2015
ISO/IEC 27001
ISO/IEC 27001 SoA
NIS2
PCI DSS
SOC 2 Type 2
TX-RAMP
VPAT
ChargePoint customers include
Citrix
Marketo
KOHLER
King County Metro
Oxford Collection Hotels
UC San Diego
Documents
DOCUMENTSEU Data Act - Information Document
DOCUMENTSChargePoint Services PCI Responsibility Matrix
REPORTSISO 27001:2022 Statement of Applicability
REPORTSNetwork Diagram
REPORTSPentest Exec Summary
COMPLIANCEISO 14001:2015
COMPLIANCEISO 45001:2018
COMPLIANCEISO 9001:2015
COMPLIANCEISO/IEC 27001
COMPLIANCEISO/IEC 27001 SoA
COMPLIANCENIS2
COMPLIANCEPCI DSS
Risk Profile
Critical Dependence
Third Party Dependence
Hosting
Product Security
Audit Logging
Data Security
Role-Based Access Control
View more
Reports
ISO 27001:2022 Statement of Applicability
Network Diagram
PCI DSS
View more
Self-Assessments
HECVAT Full
SIG Lite
Data Security
Access Monitoring
Data Backups
Data Erasure
View more
App Security
Responsible Disclosure
Bot Detection
Code Analysis
View more
Legal
Subprocessors
Cyber Insurance
Data Processing Agreement
View more
Data Privacy
ChargePoint Cloud Privacy Datasheet
Data Breach Notifications
Data Privacy Framework (DPF)
View more
Access Control
Data Access
Logging
Password Security
Infrastructure
Status Monitoring
Amazon Web Services
Anti-DDoS
View more
Network Security
DMARC
File Integrity Monitoring
IDS
View more
Corporate Security
Asset Management Practices
Email Protection
Employee Training
View more
Policies
Acceptable Use Policy
Access Control Policy
ChargePoint Security Whitepaper
View more
Security Grades
Qualys SSL Labs
chargepoint.com
A
Risk Management
Risk Assessments
Supply Chain Risk Management
Knowledge Base (FAQ)
What should I do if I don't receive the email within a few minutes?
View more
Trust Center Updates
ChargePoint's response to Core PHP Remote Code Execution (RCE) Vulnerabilities
Incidents
Security Advisory: Core PHP Remote Code Execution (RCE) Vulnerabilities ("PHP2Shell")
Summary
On October 21, 2026, security researchers disclosed two critical vulnerabilities in the core PHP runtime (CVE-2026-109618 and CVE-2026-109619, collectively termed "PHP2Shell"). These flaws reside within the PHP core request-handling engine and affect PHP runtimes serving web requests across the industry, potentially enabling unauthenticated remote code execution (RCE) via specially crafted HTTP requests.
Upon public disclosure, ChargePoint’s Information Security, Product Security, and Cloud Infrastructure teams mobilized immediately to assess our environment and enact comprehensive protective controls.
To date, ChargePoint has identified no evidence of unauthorized access, successful exploitation attempts, or compromise of any ChargePoint systems, network services, or customer data.
Affected ChargePoint Products:
ChargePoint Cloud Web Services: Affected (Underlying Runtime): Mitigated.
Certain ChargePoint applications and cloud services run on the PHP runtime. These environments have been identified and secured with active WAF blocking rules, configuration mitigations, and runtime upgrades to vendor-fixed releases. At this time, there is no evidence of successful exploitation or compromise within ChargePoint environments related to these vulnerabilities.
ChargePoint Charging Station Hardware & Firmware (Home, Commercial, Fleet): Not Affected.
Charging station operating environments and embedded firmware do not utilize PHP.
CP Mobile Applications (iOS and Android): Not Affected.
Mobile client applications do not utilize PHP.
Status
Mitigated & Monitored. All applicable Web Application Firewall (WAF) rulesets have been updated with a default action of 'BLOCK' to detect and intercept exploit attempts. We have completed an inventory of our cloud workloads, applied interim runtime configuration hardening, and upgraded affected runtimes to vendor-fixed versions in accordance with industry guidance. Continuous monitoring is active across our cloud environment, and no indicators of compromise have been observed.
Customer Action
No customer action is required for ChargePoint-managed services. ChargePoint manages all cloud infrastructure, application environments, and network protections directly. Organizations operating independent web infrastructure with self-hosted PHP runtimes are encouraged to follow vendor patching guidance published on php.net.
Contact
As part of ChargePoint’s commitment to customer security, we encourage customers with security questions to contact our InfoSec team, and we welcome security researchers to report potential vulnerabilities through coordinated disclosure.
Security inquiries (InfoSec): infosec@chargepoint.com
Media inquiries (Communications): communications@chargepoint.com
ChargePoint's response to Salesloft DRIFT incident
Incidents
https://www.chargepoint.com/blog/salesloft-drift-chatbot-breach-chargepoints-response-and-next-steps
SOC2 Type II Update
Compliance
Our SOC 2 Type II report for the period of August 1st, 2024 to July 31st, 2025 is now available through our Trust Center.
Completion of the SOC 2 Type II audit demonstrates ChargePoint’s continued commitment to the security of our ChargePoint Enterprise Charging Platform and that of our overall security posture.
Our SOC 2 Type 2 report for the period of August 1, 2023 to July 31, 2024 is now available through our Trust Center.
Our SOC 2 Type 2 report for the period of June 1, 2022 to July 31, 2023 is now available through our Trust Center.
Completion of the SOC 2 Type 2 audit demonstrates ChargePoint’s continued commitment to the security of our ChargePoint Enterprise Charging Platform and that of our overall security posture.
PCI-DSS Update
Compliance
Our updated PCI-DSS AOC for 2024 is now available through our Trust Center.
Our updated PCI-DSS AOC for 2023 is now available through our Trust Center.
ISO 27001:2022
Compliance
Our updated ISO 27001:2022 certificate is now available through our Trust Center.
If you need help using this Trust Center, please contact us.
Contact support
If you think you may have discovered a vulnerability, please send us a note.
Report issue