Obsidian Shield
CheckInLK is built on a foundation of 'Obsidian Security'—a multi-layered defense system designed to protect sensitive traveler data through advanced encryption and zero-knowledge patterns.
1. Cryptographic Standards
We utilize industry-standard cryptographic protocols to secure data at every stage. All transit is encrypted via TLS 1.3, and personally identifiable information (PII) is secured at rest using AES-256-GCM (Galois/Counter Mode). For password protection, we utilize Bcrypt with a workload factor of 12 salt rounds.
2. Authentication & JWT Rotation
Our identity management system utilizes JSON Web Tokens (JWT) with a short-lived rotation policy.
- Access Tokens: Expire in 15 minutes to minimize exposure in the event of token theft.
- Refresh Tokens: Valid for 7 days and are hashed (SHA-256) before storage. Every refresh cycle invalidates the previous token pairing.
3. Multi-Factor Authentication (MFA)
We support TOTP (Time-based One-Time Password) via the Speakeasy protocol. MFA secrets are encrypted, and one-time backup codes are stored as irreversible SHA-256 hashes, ensuring that even our internal systems cannot retrieve them once generated.
4. Automated Data Ephemerality
Security through destruction is a core tenet of CheckInLK. Our hourly cron-job (node-cron) scans the Hot Buffer every 60 minutes, identifying and permanently deleting expired identification records over 24 hours old. This prevents the accumulation of "nuclear waste" data within our infrastructure.
5. Defensive Architecture
Built on Next.js 14 with specialized server-side rendering (SSR), our frontend prevents common vulnerabilities like cross-site scripting (XSS). Our backend enforces Progressive Lockout thresholds (5/10/20 attempts) to thwart brute-force attacks and maintains an immutable audit log of all security-sensitive events.