Careful handling of distribution grid data
How eZap handles real distribution grid data.
Data processed and not stored
What eZap processes
- Aggregated 15-minute smart-meter intervals: feeder totals, not individual consumer records
- Feeder SCADA readings and historical load profiles
- Weather forecasts by feeder zone
- Data comparing forecast accuracy: actual and predicted demand
What we do not store
- Individual consumer meter records or smart-meter IDs
- Customer personal data beyond operational contact details
- One customer's network data used to train or calibrate another customer's model
- Data beyond the agreed retention period (standard: 24 months operational history)
Retention policy
Operational data is retained by default for 24 months. Forecast and dispatch schedule output remains for 12 months to benchmark accuracy. Under GDPR Article 17, customers may request earlier deletion. A full data export is available when the contract ends.
EU hosted, encrypted end to end
EU data residency
Customer data is processed and stored in EU data centers. For EU customers, it is not transferred outside the European Economic Area.
Encryption in transit and at rest
Data in transit uses TLS 1.2 or higher, while data at rest uses AES-256. APIs use Bearer token authentication with configurable expiry.
API endpoint uptime
Grid and Regional tiers offer a 99.5% monthly uptime SLA for the forecast and dispatch API endpoint. Planned maintenance occurs outside peak European grid operations hours.
Access controls
API and operator console access use role-based controls. Each user has separate credentials. Account administrators can access the full audit log. Customer data is logically isolated by account.
GDPR and operational safeguards
GDPR data processor
For all grid metering data received from customers, eZap acts as the GDPR data processor. A Data Processing Agreement is standard in every pilot and commercial agreement and covers Article 28 obligations.
NDA and confidentiality
Every pilot agreement includes a mutual NDA. Grid topology data and operational parameters are commercially confidential. Public materials do not reference customer network data.
Security controls framework
eZap was designed with SOC 2 controls for security, availability, and confidentiality. As an early commercial stage company, it has not completed a formal SOC 2 audit. A security briefing document is available on request for procurement evaluations.
Need full security briefing before evaluation?
We offer utility procurement teams a detailed security briefing document, plus a DPA for review, a security questionnaire response, and a briefing call with our technical team. Contact us.