Where we stand today
We’re an early-stage company. This page lists what we have, what we don’t, and what you can expect before anything connects to your network.
Not certified
Planned. We’ll publish the auditor and certificate number if and when we hold it.
No report
Planned after ISO 27001.
Not yet done
We’ll name the tester and scope when one is complete.
EU planned
Region and providers aren’t final. We’ll publish them before the first customer connects.
List to come
Published before the first customer connects. For a health check, the DPA names them before you send anything.
Published
See the policy below. Our security.txt is at /.well-known/security.txt.
Vulnerability disclosure
If you think you’ve found a security problem in this website or our work, please tell us.
- Write to contact@pinakashield.com with “Security report” in the subject.
- Tell us what you found, how to reproduce it and what it could affect.
- Please don’t access other people’s data, disrupt a service or publish details before we’ve had time to respond.
- We’ll acknowledge your report within five working days and keep you informed.
Supplier questions, answered as of today
Based on the requirements operators publish for their suppliers. Where the answer is no, we say so.
Not a certified one yet. See the table above. We’ll share a dated plan on request.
Read-only by design: a back-end export or read-only API. We’ll provide a data-flow diagram before any connection.
GridSEAL sits outside the charging path, so traffic doesn’t pass through it. Actions, once you enable them, run through your own back-end after a person approves.
No. Electrical protection and charger safety stay in the charger and outside GridSEAL.
Evidence from an export is only as good as what the back-end reports, so GridSEAL records it as reported by the back-end. A sensor is planned for an independent view. Actions also run through the back-end, so if it can’t be trusted, you’d act out of band, for example by cutting network access at site. That isn’t built into GridSEAL.
The Open Charge Alliance’s Security Operations Guide says the charge point operator shall set up security monitoring. Your contract should say what your vendor does for you.
No. GridSEAL works from the back-end, so ISO 15118 traffic between the vehicle and the charger, including its TLS, is outside what it can check.
Not yet. OCPP 1.6-J and 2.0.1 come first.
We’ll agree a clause that fits your 24-hour duty before any data access.
Planned. SIEM export is on the roadmap for our third release.
To be set in contract, with the sub-processor list published first.
That’s a question the register will answer. The health check can give a first view from one read-only export.
It’s a target scenario for our rules, and we’ll publish test results when we can reproduce them on a named setup.
We expect to report them for allow-listing, compensating controls or retirement. This isn’t built yet.
That’s the aim of Prove. Sealed packs are planned for the first release, and the sample on our homepage shows the idea.
Report it under the policy on this page. SBOM practice is in preparation, and GridSEAL itself may fall under the CRA.
Not yet. EU project work has been reviewed within those projects, and that isn’t a penetration test.
The design uses hybrid signatures, ECDSA P-256 with ML-DSA-65. We’ll document the upgrade path with the first release.
We’ll set return and deletion terms and an export format in the contract.