Security Architecture & Compliance Overview
Carrier-Grade Telecommunications Hardening · WIK Technologies Limited
01Cryptographic Protection & Vault Encryption
HotBill KE employs industry-standard authenticated cryptographic primitives across both transit and storage layers:
All external REST APIs, administrative dashboards, and captive portal traffic mandate TLS 1.3 encryption with strict HSTS policies and modern cipher suites.
Sensitive router administrative passwords, Daraja M-Pesa Consumer Secrets, and passkeys are encrypted with authenticated AES-256-GCM before database insertion.
02Network Perimeter & Ingress Hardening
Production reverse proxies enforce strict IP whitelisting on all M-Pesa webhook endpoints (/api/mpesa/callback), rejecting any payload not originating from authentic Safaricom Daraja gateway subnets.
Backend controllers establish point-to-point binary socket connections over Port 8728 using isolated network namespaces, preventing exposure of router management ports to public interfaces.
03Authentication & Role-Based Access Control (RBAC)
- Cryptographic Passwords: Administrative credentials are stored utilizing salted bcrypt hashes (work factor 10).
- Role Scoping: Platform features strictly compartmentalized between platform operators (
super_admin) and tenant estate managers (tenant_admin). - Brute-Force Rate Limiting: Authentication endpoints enforce strict IP and credential rate limits (
express-rate-limit) to thwart automated credential stuffing attacks. - Token Governance: Stateless JSON Web Tokens (JWT) signed with high-entropy secrets and bounded lifetimes.
04Transaction Idempotency & Fraud Prevention
To prevent financial race conditions and double-credit attacks, each M-Pesa STK Push receipt code and CheckoutRequestID is validated with atomic database locks and Redis idempotency tokens before issuing MikroTik hotspot session authorizations.
05Vulnerability Disclosure & Security Response
WIK Technologies welcomes security research and responsible vulnerability reports. If you discover a security bug or suspect unauthorized activity, please contact our security team immediately: