Built Secure.
Protected End to End.

Staff PINs are run through bcrypt — a one-way cryptographic algorithm — before ever touching the database. The original PIN is never stored anywhere, making credential theft meaningless even in a worst-case scenario.

Every staff session uses a cryptographically signed JSON Web Token that expires in 8 hours. Every single API endpoint requires a valid token — unauthenticated requests are rejected before they reach any data.

After 5 failed login attempts from a single IP address, that IP is locked out for 5 minutes. This completely defeats automated password-guessing attacks. Successful logins reset the counter instantly.

Every inbound SMS is verified using an HMAC-SHA1 signature from Twilio before any processing occurs. Requests without a valid signature are rejected instantly. It is cryptographically impossible to inject fake messages.

Every endpoint enforces per-IP request caps — login at 5/min, alert sending at 10/min, all others at 60/min. Exceeding limits triggers a cooldown. This prevents spam, abuse, and denial-of-service attempts across the board.

Every server response includes a full set of security headers — blocking clickjacking, MIME sniffing, cross-site scripting, and referrer data leakage. These headers enforce safe browser behavior on every request.

The API only accepts requests from explicitly whitelisted origins. Only app.paws-alert.com and local development are permitted. Every other website attempting to call our API is blocked before the request is sent.

Every significant action is logged with a timestamp and IP address — logins, staff changes, alerts sent. This creates an immutable paper trail for investigating anomalies and demonstrating compliance at any time.

Student enrollment requires a unique 6-character alphanumeric code that expires every 7 days. Codes are distributed only to registered staff via SMS — ensuring only students with direct instructor authorization can join a section.

All incoming data — phone numbers, messages, names — is cleaned and validated before use. Phone numbers must match E.164 format exactly. Control characters are stripped and fields are length-capped, eliminating entire classes of injection attacks.

Student phone numbers and personal data are encrypted using AES-256 before being written to the database. Even with direct database access, an attacker sees encrypted ciphertext — never real phone numbers or personal information.

All traffic between users and our servers is encrypted using TLS 1.3. SSL certificates are auto-provisioned and auto-renewed by Let's Encrypt across all domains. There is no unencrypted path to any part of the system.