Question 1

1. What authentication should a CPO require for OCPP charger connections?

Accepted Answer

Mutual TLS (OCPP 2.0.1 Security Profile 3) should be the default for any live deployment — it authenticates the physical charger with a certificate, not a password that can be copied. Profiles 1 and 2 belong in a test lab, never production.

Question 2

2. Is OCPI roaming inherently less secure than a direct bilateral integration?

Accepted Answer

Not inherently, but it adds more trust boundaries. OCPI 2.2.1's multi-role hub model means a session can pass through several parties instead of one — ask your hub how it audits access across every connected party.

Question 3

3. Does India's DPDP Act apply to a CPO operating through a white-label eMSP app?

Accepted Answer

Yes. The data fiduciary obligation attaches to whoever determines how driver data is processed, regardless of which brand the driver sees. White-labeling the front end doesn't white-label away the obligation behind it.

Question 4

4. How long should API audit logs be retained?

Accepted Answer

Long enough to cover the longer of your data-protection obligations and local tax/invoicing rules — commonly several years for billing-linked records. Confirm the exact window with local counsel rather than a platform's out-of-the-box default.

api security

Secure EV Charging API Practices Every CPO Should Demand