XML 41 R26.htm IDEA: XBRL DOCUMENT
v3.26.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Jan. 31, 2026
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management Strategy and Framework ChargePoint relies on critical internal and third-party information technology systems, including its ChargePoint Platform, mobile applications, Networked Charging Systems and network operating system, to deliver its products and services to charging station owners and EV drivers. In addition, ChargePoint stores and maintains personal, confidential and private information, including information related to its customers, vendors, mobile application users and employees. ChargePoint refers to the foregoing as its “IT Infrastructure and Confidential Information.” To safeguard the privacy and security of ChargePoint’s IT Infrastructure and Confidential Information, ChargePoint has implemented a nine-point information security management program designed to identify cybersecurity threats, assess risks, implement remediation measures, and to support internal or external reporting, as set forth below: •Product & Application Security – focuses on building capabilities to detect, mitigate, and monitor security risks to ChargePoint’s hardware (networked charging stations, embedded devices, and telematics devices) and software (ChargePoint Platform, web and mobile) products. ChargePoint conducts internal and external penetration tests, scans code and runs an active bug bounty program to detect security flaws within its architecture, design, and product components. ChargePoint’s comprehensive risk management plan then associates identified findings to ChargePoint’s risk mitigation roadmaps; •ChargePoint Platform & IT Infrastructure Security – focuses on detecting, mitigating, and monitoring risks to ChargePoint’s critical information technology and cloud infrastructure that supports its network and products. ChargePoint has configured tools to continuously scan its cloud infrastructure operating systems, containers, and code pipeline to detect vulnerabilities and software flaws, which are then remediated through its patch management program; •Data Security – focuses on building capabilities to detect, mitigate, and monitor risks to confidential (intellectual property, financials, etc.) and sensitive data (customer data, personally identifiable information, security data, etc.) and secures the data at rest and in transmission through cryptographic mechanisms; •Identity & Access Management Security – focuses on securely creating and managing identities and authorizing appropriate role-based access to ChargePoint’s network environment based on best practices; •Security Compliance – focuses on complying with applicable cybersecurity regulatory requirements and continuously monitoring the ChargePoint network environment to detect and mitigate non-compliance. ChargePoint engages external auditors and consultants to assess its information security management program as well as compliance with standards. As of January 2026, ChargePoint’s information security management programs have been certified as compliant with the ISO: 27001, SOC 2 Type 2, PCI DSS v4.0.1 standards and with the Federal Risk and Authorization Management Program (FedRAMP); •End User Security Risks – focuses on building capabilities to detect, monitor and mitigate security risks that arise from negligence and malicious insider intent. In addition to securing endpoints and their access to ChargePoint’s network environment, ChargePoint implements an active cybersecurity training and awareness program for its workforce which includes cybersecurity and privacy awareness training for all employees during onboarding and then annually thereafter. Similarly, each employee that has access to ChargePoint’s payment processing information technology environment or dedicated federal cloud environment are provided specific PCI DSS and FedRAMP awareness training prior to being granted such access and annually thereafter. ChargePoint also conducts annual phishing tests and leverages internal public forums such as townhalls, slack channels, and email newsletters to provide guidance and keep employees updated on the latest cybersecurity threats, trends, and attacks; •Third-Party Security Risks – focuses on building capabilities to detect, mitigate, and monitor security risks that arise from vendors and suppliers. ChargePoint third-party service providers are subject to a ranking and risk assessment evaluation prior to contracting with such service provider, during which time, ChargePoint assesses the third-party service providers’ security posture, practices, and relevant certifications; •Cyber Threats – focuses on building cyber threat identification capabilities by, among other methods, implementation of manual and automated tools, subscribing to reports and services to identify, detect, monitor and mitigate cyber threats in ChargePoint’s environment on an ongoing basis. In the event a threat or risk is identified, ChargePoint maintains and implements an incident response plan. Incidents, once identified or reported, are investigated by the security operation center (SOC) and incident response (IR) teams to determine the magnitude of any impact, exposure to and affects upon ChargePoint assets (if any), and to work to respond to the incident, quarantine any threat and minimize exposure to ChargePoint and its customers or vendors; and •Privacy – focuses on building capabilities to safeguard the privacy of ChargePoint’s customers, employees, and partners in alignment with local and global privacy regulations. Assessing, identifying and managing cybersecurity related risks are integrated into ChargePoint’s overall risk operating model. To the extent cybersecurity risks are identified, risk leads are assigned to gather findings and identify gaps, escalate critical or high risks and report findings to ChargePoint’s Chief Information Security Officer (“CISO”). The CISO presents critical risks and risk heat maps to the Audit Committee of the Board of Directors at least annually or more frequently as necessary. Despite ChargePoint’s investments to detect, mitigate, and monitor risks across its products, services, and operational environment, no information security management program can fully guarantee protection against all potential cybersecurity risks, and there can be no assurances that ChargePoint will not be materially affected by such risks in the future. ChargePoint remains committed to continuously enhancing its information security management program to safeguard its IT Infrastructure and Confidential Information.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Assessing, identifying and managing cybersecurity related risks are integrated into ChargePoint’s overall risk operating model. To the extent cybersecurity risks are identified, risk leads are assigned to gather findings and identify gaps, escalate critical or high risks and report findings to ChargePoint’s Chief Information Security Officer (“CISO”). The CISO presents critical risks and risk heat maps to the Audit Committee of the Board of Directors at least annually or more frequently as necessary. Despite ChargePoint’s investments to detect, mitigate, and monitor risks across its products, services, and operational environment, no information security management program can fully guarantee protection against all potential cybersecurity risks, and there can be no assurances that ChargePoint will not be materially affected by such risks in the future. ChargePoint remains committed to continuously enhancing its information security management program to safeguard its IT Infrastructure and Confidential Information.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity Leadership and Management ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO). ChargePoint’s management team, including its executive management and information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats. The IT management team has primary responsibility for ChargePoint’s overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and retained external cybersecurity consultants. ChargePoint’s IT management team has certifications from various organizations, such as CISSP (Certified Information Security Professional), CEH (Certified Ethical Hacker), CIPP (Certified Information Privacy Professional), CIPM (Certified Information Privacy Manager), OSCE (Offensive Security Certified Expert) and CISA (Certified Information Systems Auditor). ChargePoint’s IT Infrastructure and Confidential Information is managed and secured across functional reporting lines with segregated duties for responsible individuals for (1) cloud security, SOC, and individual access management, (2) governance, risk, compliance and privacy, (3) product security, and (4) infrastructure. ChargePoint’s risk assessment methodology implements continuous reporting requirements of ChargePoint’s cybersecurity risk management performance, which includes (i) a quarterly risk program status report to ChargePoint’s CISO and (ii) executive reports by the CISO on ChargePoint’s cybersecurity risk posture to executive leadership no less than every six months. Board Oversight of Cybersecurity Risk The Audit Committee of ChargePoint’s Board of Directors has primary responsibility for overseeing ChargePoint’s information security management program relating to its IT Infrastructure and Confidential Information. As part of the Audit Committee’s oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the Board of Directors dedicated to ChargePoint’s information security management program. The CISO provides updates on ChargePoint’s information security management program to the Audit Committee at least every six months and additional updates throughout the year as necessary. For further information regarding the risks to ChargePoint associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect ChargePoint, see the Risk Factors in Part 1, Item 1A of this Annual Report on Form 10-K entitled, “ChargePoint is highly reliant on its networked charging solution and information technology systems and data, and those of its service providers and component suppliers; any of these systems and data may be subject to cyber-attacks, service disruptions or other security incidents, which could result in data breaches, loss or interruption of services, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences” and “Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm ChargePoint’s business.” To date, ChargePoint has not identified any risks from a cybersecurity threat or incident, that the Company believes has, or is reasonably likely to, materially affect ChargePoint, its business strategy, results of operation or financial condition.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO).
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO). ChargePoint’s management team, including its executive management and information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats. The IT management team has primary responsibility for ChargePoint’s overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and retained external cybersecurity consultants. ChargePoint’s IT management team has certifications from various organizations, such as CISSP (Certified Information Security Professional), CEH (Certified Ethical Hacker), CIPP (Certified Information Privacy Professional), CIPM (Certified Information Privacy Manager), OSCE (Offensive Security Certified Expert) and CISA (Certified Information Systems Auditor). ChargePoint’s IT Infrastructure and Confidential Information is managed and secured across functional reporting lines with segregated duties for responsible individuals for (1) cloud security, SOC, and individual access management, (2) governance, risk, compliance and privacy, (3) product security, and (4) infrastructure. ChargePoint’s risk assessment methodology implements continuous reporting requirements of ChargePoint’s cybersecurity risk management performance, which includes (i) a quarterly risk program status report to ChargePoint’s CISO and (ii) executive reports by the CISO on ChargePoint’s cybersecurity risk posture to executive leadership no less than every six months.
Cybersecurity Risk Role of Management [Text Block] | ChargePoint’s IT Infrastructure and Confidential Information is managed and secured across functional reporting lines with segregated duties for responsible individuals for (1) cloud security, SOC, and individual access management, (2) governance, risk, compliance and privacy, (3) product security, and (4) infrastructure. ChargePoint’s risk assessment methodology implements continuous reporting requirements of ChargePoint’s cybersecurity risk management performance, which includes (i) a quarterly risk program status report to ChargePoint’s CISO and (ii) executive reports by the CISO on ChargePoint’s cybersecurity risk posture to executive leadership no less than every six months.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO). ChargePoint’s management team, including its executive management and information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats. The IT management team has primary responsibility for ChargePoint’s overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and retained external cybersecurity consultants. ChargePoint’s IT management team has certifications from various organizations, such as CISSP (Certified Information Security Professional), CEH (Certified Ethical Hacker), CIPP (Certified Information Privacy Professional), CIPM (Certified Information Privacy Manager), OSCE (Offensive Security Certified Expert) and CISA (Certified Information Systems Auditor).
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO)
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Audit Committee of ChargePoint’s Board of Directors has primary responsibility for overseeing ChargePoint’s information security management program relating to its IT Infrastructure and Confidential Information. As part of the Audit Committee’s oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the Board of Directors dedicated to ChargePoint’s information security management program. The CISO provides updates on ChargePoint’s information security management program to the Audit Committee at least every six months and additional updates throughout the year as necessary.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration