Security and deployment for OCPP and OCPI testing
OCPPLab is a hosted cloud service. Every workspace belongs to one organization, and the facts below describe how the product handles that data today. Enterprise teams can raise anything not covered here, including private deployment, in a scoped conversation before procurement.
Deployment models
Hosted cloud
OCPPLab runs as a hosted service. Teams sign up, connect a CSMS or roaming partner, and start testing without installing anything or procuring hardware.
Enterprise conversation
If internal policy requires tighter network control, a specific region, or private hosting, raise it with us on the Enterprise plan. It is scoped per customer, not a self-serve option.
Data handling
Tenant isolation
- Every workspace record is scoped to one organization.
- Database row-level security limits each signed-in member to rows of their own organization.
- Members only see the organizations they were invited to.
Encryption and access
- The web app and APIs are served over HTTPS (TLS).
- Virtual chargers support OCPP security profiles, including TLS with client certificates, when your CSMS requires them.
- Organization owners and admins manage members and roles.
Retention and deletion
- Logs are kept for 7 days on Starter and 30 days on Pro; Enterprise retention is agreed per customer.
- Chargers, locations, tokens, and other workspace records can be deleted from the product at any time.
- You can delete your account from account settings, or contact us to request deletion of other data.
Before a security review
Know your protocol scope
OCPPLab covers OCPP 1.6, 2.0.1, and 2.1 and OCPI 2.1.1, 2.2.1, and 2.3.0. Aligning on scope first keeps the review focused on the traffic you will actually send.
Check plan limits
Log retention, storage, and roaming partner limits differ by plan. The pricing page lists them, so you can match retention to your policy.
Ask us directly
For questionnaires, sub-processors, or deployment requirements, contact us. We answer with what the product does today.
Report a vulnerability
If you find a security issue in OCPPLab, email it to us. This is the contact published in our security.txt file. security@ocpplab.com
What to send
The affected URL, API, or component, the steps to reproduce, the impact you observed, and a way to reach you for follow-up questions.
Scope
Services OCPPLab operates: this website, the OCPPLab app, its public APIs, and the OCPPLab SDK. Third-party services we link to are out of scope; report those to their owners.
How to test
Use only accounts and data you own. Do not access, change, or delete other people's data, do not run denial-of-service or social-engineering tests, and stop once you have confirmed the issue. Keep details private until we have fixed it or agreed a date with you.
Inspect a sample report
See the kind of evidence buyers can review before moving deeper into evaluation.
Match deployment to plan
Use pricing to decide when cloud evaluation is enough and when Enterprise is the better fit.
Start a deployment discussion
Use contact when procurement, architecture review, or support requirements are already part of the conversation.
If your team needs a deeper review, use contact to scope protocol versions, deployment model, and support expectations before procurement work starts.