Welcome to ChargePoint's Trust Center.
At ChargePoint, we’re committed to security of all of our customers data, and service. We know people rely on us for the most convenient, dependable and safest electric vehicle (EV) charging experience possible. That’s why, since 2007, we’ve been passionate about developing the tools and technologies to promote the widespread adoption of EVs and the availability of EV charging, while also protecting grid reliability and resiliency. Today, we continue to work with national, federal, state and local agencies around the globe to proactively ensure our security standards are among the most comprehensive in the industry.
Use this Trust Center to learn about our security posture and request access to our security documentation.
Visit https://www.chargepoint.com/solutions/customer-stories for customer stories.
Citrix
Marketo
KOHLER
King County Metro
Oxford Collection Hotels
UC San Diego
- What should I do if I don't receive the email within a few minutes?
Trust Center Updates
ChargePoint's response to Core PHP Remote Code Execution (RCE) Vulnerabilities
Security Advisory: Core PHP Remote Code Execution (RCE) Vulnerabilities ("PHP2Shell")
Summary
On October 21, 2026, security researchers disclosed two critical vulnerabilities in the core PHP runtime (CVE-2026-109618 and CVE-2026-109619, collectively termed "PHP2Shell"). These flaws reside within the PHP core request-handling engine and affect PHP runtimes serving web requests across the industry, potentially enabling unauthenticated remote code execution (RCE) via specially crafted HTTP requests.
Upon public disclosure, ChargePoint’s Information Security, Product Security, and Cloud Infrastructure teams mobilized immediately to assess our environment and enact comprehensive protective controls.
To date, ChargePoint has identified no evidence of unauthorized access, successful exploitation attempts, or compromise of any ChargePoint systems, network services, or customer data.
Affected ChargePoint Products:
-
ChargePoint Cloud Web Services: Affected (Underlying Runtime): Mitigated.
Certain ChargePoint applications and cloud services run on the PHP runtime. These environments have been identified and secured with active WAF blocking rules, configuration mitigations, and runtime upgrades to vendor-fixed releases. At this time, there is no evidence of successful exploitation or compromise within ChargePoint environments related to these vulnerabilities. -
ChargePoint Charging Station Hardware & Firmware (Home, Commercial, Fleet): Not Affected.
Charging station operating environments and embedded firmware do not utilize PHP. -
CP Mobile Applications (iOS and Android): Not Affected.
Mobile client applications do not utilize PHP.
Status
Mitigated & Monitored. All applicable Web Application Firewall (WAF) rulesets have been updated with a default action of 'BLOCK' to detect and intercept exploit attempts. We have completed an inventory of our cloud workloads, applied interim runtime configuration hardening, and upgraded affected runtimes to vendor-fixed versions in accordance with industry guidance. Continuous monitoring is active across our cloud environment, and no indicators of compromise have been observed.
Customer Action
No customer action is required for ChargePoint-managed services. ChargePoint manages all cloud infrastructure, application environments, and network protections directly. Organizations operating independent web infrastructure with self-hosted PHP runtimes are encouraged to follow vendor patching guidance published on php.net.
Contact
As part of ChargePoint’s commitment to customer security, we encourage customers with security questions to contact our InfoSec team, and we welcome security researchers to report potential vulnerabilities through coordinated disclosure.
Security inquiries (InfoSec): infosec@chargepoint.com
Media inquiries (Communications): communications@chargepoint.com
ChargePoint's response to Salesloft DRIFT incident
SOC2 Type II Update
Our SOC 2 Type II report for the period of August 1st, 2024 to July 31st, 2025 is now available through our Trust Center.
Completion of the SOC 2 Type II audit demonstrates ChargePoint’s continued commitment to the security of our ChargePoint Enterprise Charging Platform and that of our overall security posture.
Our SOC 2 Type 2 report for the period of August 1, 2023 to July 31, 2024 is now available through our Trust Center.
Our SOC 2 Type 2 report for the period of June 1, 2022 to July 31, 2023 is now available through our Trust Center.
Completion of the SOC 2 Type 2 audit demonstrates ChargePoint’s continued commitment to the security of our ChargePoint Enterprise Charging Platform and that of our overall security posture.
PCI-DSS Update
Our updated PCI-DSS AOC for 2024 is now available through our Trust Center.
Our updated PCI-DSS AOC for 2023 is now available through our Trust Center.
ISO 27001:2022
Our updated ISO 27001:2022 certificate is now available through our Trust Center.