Designed for Security.
Engineered for Compatibility.
Kiwire 4.0 delivers enterprise-grade security while seamlessly integrating with your existing infrastructure. Designed to protect, scale, and simplify network management, it empowers businesses to deploy secure connectivity without disrupting current systems or workflows.
Multi-Factor Authentication (TOTP)
RFC 6238 TOTP-based MFA enforced for all admin accounts. First-time setup is mandatory; QR code provisioning for Google Authenticator and compatible apps.
Idle Session Timeout
Sessions automatically terminated after 30 minutes of inactivity. Both server-side enforcement and client-side JS heartbeat protection.
Role-Based Access Control (RBAC)
Granular permission system per admin role. Pre-built Manager and Viewer roles. Full permission matrix customizable per tenant.
Tamper-Evident Audit Trail
Every admin action recorded with user ID, IP address, user-agent, URL, and timestamp. Checksum-protected records prevent undetected tampering.
Content Security Policy (CSP)
Full CSP headers on every page response: default-src self, object-src none, frame-src restricted to Google reCAPTCHA only.
CSRF Protection
Laravel CSRF token middleware on all state-mutating routes. SPA AJAX calls verified via X-CSRF-Token headers automatically.
Bcrypt Password Hashing
All admin passwords stored using Laravel's bcrypt hashing (cost factor 12+). No plaintext passwords stored in the system database.
Security Alert Notifications
Automated email alerts for: repeated failed logins, MFA disabled, superuser session started, and admin account deactivated.
Hashed API Keys
Admin REST API keys are SHA-256 hashed before storage. Rate limiting and IP allowlisting enforced per API key.
Server Header Suppression
X-Powered-By and Server headers removed from all responses to prevent technology fingerprinting by attackers.
Password Expiry Policy
Admin passwords expire every 90 days. Users are force-redirected to change their password before accessing any system resources.
HTTPS / HSTS Enforcement
Strict-Transport-Security header with 1-year max-age, includeSubDomains, and preload flag enforced on all responses.
Multi-Tenant Database Isolation
Each tenant runs on a completely separate database. No cross-tenant data leakage possible by design — connection is resolved per request.
Admin Session Binding
Single active session enforcement per admin account. New login invalidates any concurrent session on another device or browser.