We take a number of steps to secure the app's infrastructure where security extends from the mobile app to the APIs.


  1. Use of keychain on iOS to store all credentials.
  2. All APIs are secured with a wildcard SSL certificate.
  3. Use of JWT and JWE for securing all APIs.
  4. Load Balancer supported for horizontal scaling.
  5. All customer data on the server is encrypted using 128-bit AES encryption.
  6. Rate limit API and controller access to minimize the harm from automated attack tooling.
  7. App secured from any DB injection.
  8. App protected from clickjacking protection, XSS, MIME-Sniffing, HSTS, HPKP, or set the CORS settings.
  9. Security headers are enabled.
  10. Scripts are not deployed with default credentials, particularly for admin users.
  11. Uses a server-side, secure, built-in session manager that generates a new random session ID with high entropy after login. Session IDs should not be in the URL. Ids should also be securely stored and invalidated after logout, idle, and absolute timeouts.
  12. JWT tokens are invalidated on the server after logout.