At Envitron, information security and quality are at the heart of everything we do. Our energy management platform is built to deliver efficient and sustainable energy solutions, backed by the highest standards of security, reliability, and quality. We could talk for hours about safety and quality, but below you’ll find a short overview of how we put this promise into practice.

 

Core process

The security of our hardware and software is not an afterthought, but an integral part of our business operations. From the design phase through implementation and maintenance, we embed security measures to eliminate potential risks. Our processes are certified under ISO 27001 and ISO 9001.

 

Infrastructure

Our infrastructure and mobile connections are fully managed in-house. All data storage and system control are handled from Dutch data centers. This ensures that we operate under strict Dutch and European data protection regulations, such as NIS2 and the GDPR.

Hardware

The Envi.Base is a truly Dutch product, designed in-house and manufactured by trusted partners in the Netherlands. With its wide range of connection options, it has been purposefully engineered to never allow any external access. Discover more about our dedicated security measures here.

Redundancy and availability

Where necessary, our systems are built with redundancy to guarantee high availability. This ensures reliable and uninterrupted service at all times. We actively monitor availability, and customers can view the live status themselves at status.my.envitron.nl.

Backup and disaster recovery

Even if something does go wrong, we have a comprehensive backup strategy in place. Regular backups are made of all critical data and systems. Thanks to our disaster recovery plans, we can quickly resume services in the event of a disruption or incident—ensuring minimal impact on our customers’ business operations.

 

Data encryption

To guarantee the security of all information, we apply industry-standard encryption technologies. Data is encrypted both at rest and in transit, following industry standards and best practices to ensure the highest level of protection.

Testing

We carry out extensive testing and quality checks on all our hardware and software. This includes automated unit tests, integration tests, and peer reviews. In addition, we engage independent external parties to perform penetration tests on our hardware, software, and infrastructure at least once a year. For this, we work closely with specialized security partners such as Warpnet and New Nexus.

Audits

At Envitron, we don’t mark our own homework. Once a year, our security and quality processes are thoroughly reviewed by an external auditor. This ensures continuous focus on improvement, while keeping our ISMS (Information Security Management System) and QMS (Quality Management System) up to standard. In this process, we are supported by Nestor Security as external auditors and Dekra as our certification authority.

 

Monitoring

Measuring is knowing—and that applies to us as well. Our hardware, software, servers, and infrastructure are continuously monitored to ensure security, functionality, and capacity, allowing us to respond proactively. This helps prevent potential threats or outages. We rely on tools such as Wazuh, Defender, Zabbix, and Sentry to safeguard our systems. Our security team responds immediately to any threats detected.

Security Awareness

We recognize that technical measures alone are not enough to guarantee security. When working with systems and data, it is crucial that everyone is aware of potential risks, such as social engineering. That is why we invest heavily in awareness, for example through Awaretrain simulations and training provided by Nestor Security.

 

Privacy

We attach great importance to the privacy of our customers and their data. We comply with all relevant data protection laws and regulations and follow a strict privacy policy. Customer data is used solely for the purpose for which it was collected and is never shared with third parties without explicit consent. Read the full details in our Privacy Policy.

Quality

We hold ourselves to very high standards, but sometimes things may not go exactly as planned. That’s why we say: mistakes are allowed—but only if we learn from them. We actively seek feedback from our customers and aim to provide the best possible support. And in the rare case that something goes wrong, customers can rely on our official complaints procedure.

Efficiency

Envitron’s mission is to make the most efficient use of locally and sustainably generated energy. Naturally, we don’t want to be part of the problem ourselves. That’s why we closely monitor the energy consumption of both the Envi.Base and our data center servers. Envitron is proud to state that we fully comply with the Energy Efficiency Declaration, part of the officially recognized energy-saving measures.

 

Questions and answers

Below are our most frequently asked questions about quality and security. Click on a question to view the answer.

Is Envitron dependent on American cloud services?

In short: no. We are proud that design, production, management, and data are all handled in our own country and under our own control—completely independent from foreign tech giants. All data storage and system control take place in Dutch data centers, making us unique in the energy management systems market.

What specific security measures are in place for the Envi.Base?

We know the saying, “The S in IoT stands for Security,” which is why we continually look for ways to prevent misuse of our hardware. Specific measures include:

  • All connections are always initiated from the Envi.Base.
  • Incoming connections from the outside are not permitted and are blocked by default.
  • We use a dedicated mobile connection that we manage in-house.
  • Outgoing connections are always encrypted.
  • The Envi.Base communicates only with known servers.
  • Hardware is closely monitored to detect and respond to potential misuse or hacking attempts.
  • External parties conduct both white-box and black-box penetration tests to validate our security.

Which encryption technologies do you use?

Not every door requires the same type of key—the same applies to encryption technologies. As computers grow more powerful, the likelihood of brute-force attacks increases. That is why we carefully follow industry recommendations and closely monitor new developments. At present, depending on the application, we use the following standards:

Data in transit (in flight)

  • Transport Layer Security (TLS)
  • Algorithm: AES (Advanced Encryption Standard)
  • Key size: 128-bit
  • Mode of operation: Galois/Counter Mode (GCM)
  • Cryptographic hash function: SHA-256
  • Maximum X509 certificate validity: 3 months

Data at rest

  • Laptops: Apple Mac FileVault
  • Servers: AES 256-bit, ECC Curve25519

Why a mobile connection? Can’t the Envi.Base run on my own data network?

Together with our connectivity partner ThingsData, we maintain full control over the entire network chain. This not only adds value to the quality of the connection, but also allows us to secure and monitor the full chain according to our own standards. Many customers lack the expertise or resources to adequately secure or monitor their own networks. That is why we provide this crucial part of our service by default, in order to minimize risk.

Of course, exceptions are possible—and always open for discussion.

Are you ISO certified?

Yes! We are certified for the following standards:

  • ISO 27001
  • ISO 9001
  • VCA
  • NEN 3140

Learn more on this page.

Are you NIS2 certified?

The NIS2 directive is European legislation aimed at strengthening cybersecurity within EU member states. While there is no formal NIS2 certification comparable to ISO standards, we are fully aware of its requirements and actively work to comply with them. Our current ISO 27001 and ISO 9001 certifications reflect our commitment to information security and quality management, helping us meet the demands set by NIS2.

What does your backup plan look like?

The data from our energy monitoring system is secured in real time on separate hardware within the same data center. In addition, we create a daily snapshot of this data, which is encrypted and stored at an external location. Depending on the type of data, we retain these backups for up to one year.

However, a backup is only valuable if it can be restored. That’s why we test our recovery procedures and the quality of our backups twice a year.

Do you have a dedicated security team?

Yes! Envitron has a specialized security team responsible for monitoring our systems. In the event of an information security incident, this team responds immediately to minimize impact and take appropriate measures. This proactive approach contributes to the safety and reliability of our services.

If you have additional questions for this team, you can reach them at security [at] envitron.com.

How does Envitron manage its own energy use?

We believe it is an essential quality not to become part of the problem ourselves. That’s why we pay close attention to our own energy consumption.

Envi.Base: The Envi.Base is designed to operate with exceptional energy efficiency. Its average consumption, depending on activity, ranges between 2.5 and 5.1 watts.

Servers: Together with the Dutch Data Center Association (DDA), our data centers launched a sector-wide initiative to reduce energy consumption in data centers. This initiative resulted in the Energy Efficiency Declaration, which includes optimizing server power management settings as a measure on the List of Recognized Energy-Saving Measures (EML) for data centers. Envitron is proud to report that all our servers fully comply with this measure. The average consumption of a Virtual Machine at Envitron is below 25 watts!