Signed, single-use unlock commands
Every unlock is an Ed25519-signed command bound to one door, one request and a short expiry. The door refuses anything unsigned, expired, for another door, or already used.
Security
Built like a lock, not like a website.
Security is designed into every step, from the factory to the door.
No secrets in the phone
The app never holds a key that can open a door. Every permission is decided by the server at the moment of the request.
Mutual TLS for doors
Each door has its own certificate. The message broker accepts only known doors, and a revoked door is cut off.
Bluetooth challenge-response
Offline unlocks use a fresh challenge from the door, so a recorded token cannot be replayed.
Encrypted Wi-Fi setup
The hotel Wi-Fi password is encrypted for a single door (X25519 + AES-256-GCM) and never sent to or stored on our servers.
Signed firmware, no downgrades
Firmware is signed offline; the server and the door both verify it, and doors refuse older versions.
Strict tenant isolation
Every query is scoped to the hotels a user is allowed to see. Other hotels look like they do not exist.
Audit trail
Administrative actions are logged with a hash chain so that edits or deletions are detectable.
Hardware security features such as flash encryption and secure boot are enabled per production batch after review; ask us for the current status of your devices.