Connected inverter and cybersecurity: data, cloud and access to check before purchasing

Decision to make

Monitoring is not just an application: updates, accounts, remote access, data export and off-cloud operation must be checked. Adapt this decision to the building, your actual consumption and the project schedule.

For this project, start by identifying the grid operator, applicable tariff and site constraints. The quotation must specify the conditions affecting connection, metering or the value of surplus electricity.

Practical effects of the project

These points help assess the topic ‘ Connected inverter and cybersecurity: data, cloud and access to check before purchasing ’ without turning a national average into a local promise. Every decisive figure needs its source, date and scope.

Specific controls

The answers should appear in the quote or in a dated appendix. A verbal explanation is insufficient if it changes the price, expected output, financial support or a contractual obligation.

Compare quotes

Monitoring is not just an application: updates, accounts, remote access, data export and off-cloud operation must be checked. In the comparison table, keep one column for the stated value, one for the evidence provided, and one for the effect of a less favorable hypothesis.

Cautious scenario

Test the project with slightly lower production, an unconfirmed grant and less favourable surplus remuneration. This scenario shows whether the decision remains sound based on self-consumption, roof quality and a controlled installed cost.

The main references used are NCSC - measures to protect connected devices, SFOE - permits and low-voltage installations, OFEN/BFE - Connection conditions and remuneration 2026, Swissolar - Swiss Solar Monitor. They frame the method, but the local amounts and contractual conditions must be rechecked at the time the offer is signed.

Risks to be managed

BACS/NCSC recommends for IoT devices to limit exposure, avoid default identifiers, update software, and separate devices from the personal network when possible. Ask who assumes this risk, what proof will be provided and how a change is handled after ordering.

A more expensive solution should meet a specific need in your project. Ask for a documented benefit and a separate price for each option.

Next step

Gather the address, annual consumption, future electricity uses and building documents. Then check the grid operator's conditions, available grants and site constraints; request quotations covering the same scope.

Monitoring is not just an application: updates, accounts, remote access, data export and off-cloud operation must be checked. You can then decide with a documented net price, clear responsibilities and assumptions that each company can explain line by line.

Take inventory of access

Start by listing the connected devices: inverter, gateway, meter, EMS, terminal, router and application. Note for each the account owner, service account, connection method, and what happens if internet access disappears. This inventory shows that simple monitoring can also affect consumption data and energy controls.

Upon delivery, the main account must be created in the name of the owner with a unique password. The installer can maintain limited service access if the support requires it, but its duration, rights and revocation must be known. Don't leave a password printed in a manual or a shared account that no one can change.

Updates and end of support

Ask about the frequency of updates, how an alert is sent, how long it takes to fix a vulnerability, and how long the exact model is supported. A device that is still receiving updates does not have the same operational risk as a discontinued product. The supplier must also explain who intervenes when the firmware, application or cloud changes.

Updates should not be treated as a purely IT chore. They can change settings, compatibility, access and offline operation. Keep the installed version and test production, alarm and controls after a major change, with professional help if necessary.

Data and cloud dependence

Production per quarter hour, consumption, power, events and times can reveal the habits of a household. Ask what data is collected, why, for how long, where it is processed, who accesses it and how to export or delete it. Choosing a cloud should be an informed choice, not a hidden consequence of warranty.

Also ask what happens when you move, change installer or sell the property. Accounts, historical data and authorizations must be able to be transferred without rendering the installation unusable. A pretty application does not compensate for the inability to retrieve data or contact support.

Local operation and home network

Have local control and safe behavior tested without internet. The installation must keep its protections; locally available production, shutdown, alarm and adjustment functions must be documented. For a terminal or EMS, ask how the system reacts if the cloud stops responding for several hours.

BACS/NCSC recommends limiting exposure from IoT devices, changing default identifiers, applying updates, and separating devices from the personal network when possible. The owner does not need to turn his house into a data center: a dedicated network, no unnecessary internet openings and encrypted connections already reduce the attack surface.

Reception and incident plan

Add an access sheet to your receipt: accounts, second factor, software version, security contact, last test date, reset procedure and off-cloud operation. Do not copy passwords in a shared quote; return them safely and have them changed by the owner.

If an account is compromised, disconnect remote access if security permits, change credentials, verify users, and contact the manufacturer or installer. Do not deactivate an electrical protection to restore an application. A good digital system protects availability and confidentiality without complicating normal operation of the facility.