Skip to main content

Security and Quality

At Envitron, information security and quality are central to everything we do. Our energy management platform is designed to provide efficient and sustainable energy solutions, with a guarantee of the highest standards in the areas of security, reliability, and quality. We could talk about security and quality for hours. Below is a brief overview of how we deliver on this promise.

Core Process​

The security of our hardware and software is not an afterthought, but an integral part of our business processes. From the design phase through implementation and maintenance, we integrate security measures to eliminate potential risks. Our processes are ISO-27001 and ISO-9001 certified.

Infrastructure​

Our infrastructure and mobile connections are managed in-house. All data storage and system control takes place from Dutch data centers. As a result, we fall under the strict Dutch and European legislation in the area of data protection, such as NIS2 and the GDPR.

Hardware​

The Envi.Base is a truly Dutch product, designed in-house and manufactured by Dutch partners. Despite its large number of connection options, the Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting. is designed in such a way that it will never allow connections from the outside. Read more here about our specific security measures.

Redundancy and Availability​

Our systems are made redundant where necessary to guarantee high availability. This ensures a reliable and uninterrupted service. We naturally measure availability, and customers can also view it via status.my.envitron.nl.

Backup and Disaster Recovery​

Should something go wrong, we have a comprehensive backup plan in which we regularly create backups of all critical data and systems. Thanks to our disaster recovery planslan Lokaal (bedrijfs)netwerk binnen een gebouw of terrein., we can quickly resume service in the event of a disruption or emergency, with minimal impact on our customers' business processes.

Data Encryption​

To guarantee the security of all data, we use encryption technologies. Data is encrypted both during storage and during transport, and we use industry standards and recommendations for the highest level of security.

Testing​

We conduct extensive tests and quality checks on all our hardware and software ourselves. We do this through automated unit tests, integration tests, and peer reviews. In addition, we engage independent external parties to assess our hardware, software, and infrastructure at least twice a year through penetration tests. We work closely with parties such as Warpnet and New Nexus.

Audits​

We don't let the fox guard the henhouse. Once a year, our security and quality processes and working methods are scrutinized by an external auditor. This ensures that we continuously focus on improvement, while also maintaining our ISMS (Information Security Management System) and QMS (Quality Management System) at the required level. We receive support from Nestor Security as external auditors and Dekra as the certification authority.

Monitoring​

You can't manage what you don't measure — and that applies to ourselves too! Our hardware, software, servers, and infrastructure are extensively monitored to guarantee security, functionality, and capacity, and to respond proactively. This keeps potential threats and/or outages at bay. We use, among others, Wazuh, Defender, Zabbix, and Sentry for our monitoring. Our information security team responds immediately to threats detected by these systems.

Awareness​

We recognize that technical measures alone are not sufficient to guarantee security. When working with systems and data, it is vitally important that everyone is aware of potential dangers, such as social engineering. We therefore invest heavily in awareness, for example by using simulations from Awaretrain and training from Nestor security.

Privacy​

We attach great importance to the privacy of our customers and their data. We comply with all relevant legislation and regulations in the area of data protection and maintain a strict privacy policy. Customer data is used exclusively for the purpose for which it was collected and is never shared with third parties without explicit consent. Read the exact policy in our Privacy Policy.

Quality​

We are very critical of our own work, but it can happen that things don't go as we intended. We therefore say: making mistakes is allowed, but only if you learn from them. That is why we actively seek feedback from our customers and try to help everyone as best we can. And in the most extreme case, the customer can make use of our complaints procedure!

Efficiency​

Envitron's mission is to make the most efficient use of locally and sustainably generated energy. We naturally don't want to be part of the problem ourselves. That is why we critically examine the energy consumption of both the Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting. and our servers in the data centers. Envitron is proud to report that we fully comply with the Energy Efficiency Declaration (part of the recognized energy-saving measures).

Questions and Answers

Below are our most frequently asked questions about quality and security. Click on a question to see the answer.

Is Envitron dependent on American cloud services?

Simply put: no. We are proud that we keep design, production, management, and data entirely in our own hands and in our own country. Completely independent of foreign tech giants. All data storage and system control takes place from Dutch data centers. And that makes us unique in the energy management systems market.

What specific security measures do you have for the Envi.Base?

We know the saying "The S in IoT stands for Security," and that is why we actively continue to look for measures to prevent misuse of our hardware. Specific measures include:

  • Connections are always initiated from the Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting..
  • Connections from the outside are not permitted by default and are blocked.
  • We use a specially configured mobile connection that we manage in-house.
  • Outbound connections are always encrypted.
  • The Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting. communicates exclusively with known servers.
  • There is precise monitoring of the hardware, so that we can detect and respond to potential misuse or hacking attempts.
  • We conduct white- and black-box penetration tests by external parties to validate our security.
What encryption technologies do you use?

Not every door needs the same type of key. The same applies to encryption technologies. With increasingly powerful computers entering the scene, the likelihood of brute-force cracking continues to grow. We therefore carefully monitor industry recommendations and closely follow new developments. Currently, depending on the application, we use the following standards:

  • Data in transport (in flight)
    • Transport Layer Security (TLS)
    • Algorithm: AES (Advanced Encryption Standard),
    • Key size: 128 bit key size,
    • Mode of operation: Galois/Counter Mode (GCM)
    • Cryptographic hash function: SHA-256
    • Maximum validity date X509 certificate: 3 months
  • Data at rest (data in rest)
    • Laptops: Apple MAC FileVault
    • Servers: AES 256-bit, ECC Curve25519
Why a mobile connection? Can the Envi.Base not connect to my own data network?

With our connectivity partner ThingsData, we have full control over the entire network chain. This not only adds value to the quality of the connection, but also enables us to secure and monitor the entire chain according to our own standards. Many customers do not have the expertise or manpower to adequately secure or monitor their own networks. That is why we offer this crucial part of our service as standard to minimize the risk.

Of course, exceptions are possible, and this is always open for discussion.

Are you ISO certified?

Yes! We are certified for the following standards:

  • ISO-27001
  • ISO-9001
  • VCA
  • NEN-3140

See this page for more information.

Are you NIS2 certified?

The NIS2 directive is a European piece of legislation aimed at raising the level of cybersecurity across EU member states. Although there is no formal NIS2 certification like there is for ISO standards, we are fully aware of the requirements of the NIS2 directive and are actively working to comply with them. Our current ISO 27001 and ISO 9001 certifications reflect our commitment to information security and quality management, which helps us meet the requirements set out in NIS2.

What does your backup plan look like?

The data from our energy monitoring system is secured in real time on separate hardware in the same data center. In addition, we take a daily snapshot of this data, which we store encrypted at an external location. Depending on the type of data, we retain this data for a maximum of one year.

However, a backup is not a backup if it cannot be restored. That is why we test our recovery instructions and the quality of the backups twice a year.

Do you have a dedicated team for information security?

Yes! Envitron has a specialized security team that is responsible for monitoring our systems. In the event of any information security incidents, this team responds immediately to minimize the impact and take appropriate measures. This proactive management contributes to the security and reliability of our services.

If you have additional questions for this team, you can reach them at security [at] envitron.com.

How does Envitron itself handle energy?

We consider it an important principle not to become part of the problem ourselves! That is why we pay a great deal of attention to our own consumption.

Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting.: The Envi.Baseenvi.base De energiecontroller van Envitron die apparaten uitleest, aanstuurt en data opslaat achter de hoofdaansluiting. is designed to be exceptionally energy-efficient. Average consumption, depending on activity, is between 2.5 and 5.1 watts.

Servers: Our data centers, together with the industry association Dutch Data Center Association (DDA), have launched a sector initiative to reduce energy consumption in data centers. This initiative has led to the Energy Efficiency Declaration, which includes the optimization of power management settings on servers as a measure on the Recognized Measures List (EML) for data centers. Envitron is proud to report that all our servers fully comply with this measure. The average consumption of a Virtual Machine at Envitron is below 25 watts!