Zero trust · Cryptographically auditable · Post-quantum roadmap
Security and compliance
built for critical infrastructure.
AmpVerve connects to EV fleets, building heating systems, and grid assets. Security is not a feature we add. It is the architecture everything else is built on. Zero trust, cryptographically auditable, and designed to meet the regulatory frameworks that govern the sectors we operate in.
Security architecture
Four pillars.
Every deployment.
Zero Trust Architecture
No implicit trust between any component. Every request authenticated, authorised, and encrypted regardless of network origin. TLS 1.3 minimum. mTLS for all service-to-service communication. Hardware security modules for key management.
Cryptographic Audit Trail
Every dispatch is signed with Ed25519 and every settlement record carries a SHA-256 verifier hash, so any record can be checked independently against the key that signed it. Built to support FOI, clinical governance, and regulatory requirements.
Post-Quantum Roadmap
Quantum computers pose a threat to current cryptographic standards on a 10–15 year horizon. AmpVerve is adopting NIST-selected post-quantum algorithms for key exchange and digital signatures, so data protected today is designed to remain secure against future compute capabilities.
Edge Autonomy
The on-site execution agent operates independently of cloud connectivity. Local constraint enforcement and dispatch continue through internet outages, protecting operational continuity even when the cloud link is interrupted.
Compliance frameworks
Standards alignment
that matters to your sector.
AmpVerve is built to meet the regulatory frameworks that govern the sectors we serve, from electricity market settlement to healthcare data protection.
In progress
SOC 2 Type II
Security, Availability, Confidentiality
Annual independent audit of security controls covering the trust services criteria. Provides formal third-party assurance that AmpVerve’s systems protect operator and end-user data with appropriate controls.
Planned
ISO 27001
Information Security Management System
International standard for information security management systems. Covers risk assessment, controls, and continuous improvement. Expected across financial services and critical infrastructure procurement.
Compliant
GDPR
General Data Protection Regulation
UK GDPR compliance for personal data processing, with data minimisation applied by design. Data Processing Agreements available to partners. UK ICO registration in progress.
Aligned
NIS2
Network and Information Security Directive 2
EU cybersecurity directive for essential and important entities, relevant to energy operations in the EU. AmpVerve’s security controls align with NIS2 Article 21 requirements for risk management measures.
On roadmap
DSPT / NHS DTAC
Data Security and Protection Toolkit
NHS Data Security and Protection Toolkit assessment and Digital Technology Assessment Criteria, required for digital tools deployed in NHS settings. On the roadmap for healthcare deployment.
In assessment
Elexon BSC
Balancing and Settlement Code
AmpVerve’s Elexon BSC application is in assessment, with MPID AMPV allocated. Virtual Lead Party, Asset Metered VLP and Virtual Trading Party roles are in qualification, not held. The metering and settlement data integrity requirements are addressed by AmpVerve’s signed audit records.
Post-quantum cryptography
Preparing for
quantum-era threats.
Quantum computers capable of breaking current RSA and ECC encryption are projected within 10–15 years. “Harvest now, decrypt later” attacks mean adversaries are collecting encrypted data today to decrypt once quantum compute arrives.
AmpVerve is adopting NIST-selected post-quantum algorithms across key exchange and digital signature operations, designed to protect data against both current and emerging threats.
CRYSTALS-Kyber (ML-KEM)
NIST-standardised post-quantum key encapsulation mechanism, selected to replace RSA and ECDH for key exchange across AmpVerve service-to-service communication.
CRYSTALS-Dilithium (ML-DSA)
NIST-standardised post-quantum digital signature algorithm, selected to replace ECDSA for signing audit trail entries, dispatch instructions, and settlement records.
TLS 1.3 Hybrid Mode
Combined classical and post-quantum key exchange in TLS 1.3 connections. Provides protection against both classical and quantum attacks during the transition period.
SHA-256 Record Verifier Hashes
Cryptographic audit trail uses SHA-256, which remains quantum-resistant (requires Grover’s algorithm, providing only square-root speedup versus exponential for RSA). Audit evidence remains secure.
Developer tools
Everything you need
to integrate securely.
Tooling for integration, testing, and ongoing operation, with security built into the developer experience.
API Key Management
Generate and manage API keys with granular scopes, rate limits, IP allowlisting, and automatic rotation. Keys are hashed at rest and never stored in plaintext. Full key audit history with creation, last-use, and revocation timestamps.
Scoped permissions · Rate limiting · IP allowlisting · Automatic rotation
Webhooks with Signatures
Continuous event notifications for dispatch changes, alerts, and settlement events. Every webhook payload is signed with HMAC-SHA256. Replay protection via timestamp validation and idempotency keys. Configurable retry logic with exponential backoff.
HMAC-SHA256 signatures · Replay prevention · Configurable retry
OCPP Testing Utilities
Testing utilities for OCPP 1.6 and 2.0.1 charger integrations. Simulate dispatch scenarios, fault conditions, and connectivity interruptions in a sandboxed environment before production deployment. No live grid exposure during testing.
OCPP 1.6 & 2.0.1 · Fault simulation · Sandboxed environment
SDK and API Reference
Python, Node.js, and Go SDKs with full TypeScript type definitions. OpenAPI 3.1 specification available for automated client generation. Interactive API explorer with request testing against a sandbox environment.
Python · Node.js · Go · TypeScript · OpenAPI 3.1
Security questions
answered directly.
Every security enquiry reaches our technical team directly. We provide detailed responses to security questionnaires, penetration test requirements, and compliance documentation requests.
hello@ampverve.com · Security documentation available under NDA