Security and Privacy
Linkr is designed with security and privacy as core principles. This document describes our approach to protecting user data, securing communications, and maintaining the integrity of the network.
Security Principles
Defense in Depth
Multiple layers of security protect the system:
- Network layer: TLS encryption, firewalls, DDoS protection
- Application layer: Authentication, authorization, input validation
- Data layer: Encryption at rest, access controls, audit logging
- Operational layer: Monitoring, incident response, regular audits
Least Privilege
All components operate with minimum necessary permissions:
- Services only access the data they need
- API keys are scoped to specific operations
- Operator access is limited to their own hotspots
- Internal tools require role-based authentication
Zero Trust
No implicit trust between components:
- All service-to-service communication is authenticated
- Network location doesn’t grant access
- Every request is verified independently
Authentication
User Authentication
Users authenticate using email and password:
- Passwords are hashed using Argon2id
- Minimum password requirements enforced
- Optional two-factor authentication (TOTP)
- Session tokens expire after 30 days of inactivity
API Authentication
API access uses bearer tokens:
curl -H "Authorization: Bearer lnkr_sk_live_..." \
https://api.linkr.network/v1/hotspots
- Tokens are generated through the dashboard
- Each token has configurable scopes
- Tokens can be revoked at any time
- Usage is logged for audit purposes
Hotspot Authentication
Hotspots authenticate using device credentials:
- Unique device key generated during linking
- Keys are stored securely on the device
- Challenge-response protocol prevents replay attacks
- Compromised keys can be revoked remotely
Encryption
In Transit
All network communication is encrypted:
| Connection | Protocol | Notes |
|---|
| Client to API | TLS 1.3 | HSTS enabled, certificate pinning in mobile apps |
| Hotspot to API | TLS 1.3 | Certificate validation required |
| Service to service | mTLS | Mutual authentication between internal services |
| User to hotspot | WPA2/WPA3 | Standard Wi-Fi encryption |
At Rest
Sensitive data is encrypted in storage:
- Database: Transparent data encryption (TDE)
- Backups: AES-256 encryption
- Object storage: Server-side encryption
- Secrets: Hardware security modules (HSM) for key storage
Privacy Model
User Data
We collect only the data necessary to operate the service:
| Data Type | Purpose | Retention |
|---|
| Account info | User identity, authentication | Account lifetime |
| Location (operators) | Hotspot placement on map | Account lifetime |
| Session data | Connection tracking, quality metrics | 1 year |
| Usage analytics | Service improvement | Aggregated indefinitely |
What We Don’t Collect
- Traffic content: We don’t inspect or store the contents of your internet traffic
- Browsing history: We don’t track which websites you visit
- Precise user location: We know which hotspot you connected to, not your exact position
- Device identifiers: We don’t collect hardware IDs from connecting devices
Data Anonymization
Analytics and aggregate data use anonymization techniques:
- User IDs replaced with random identifiers
- Location data generalized to grid cells
- Small populations suppressed to prevent re-identification
- Differential privacy applied to sensitive aggregates
We never sell user data or share it with advertisers. See our Privacy Policy for full details.
Hotspot Security
Network Isolation
Hotspots should isolate Linkr traffic from private networks:
Internet
│
▼
┌─────────────────────────────────────┐
│ Router/AP │
│ ┌─────────────┐ ┌─────────────┐ │
│ │ Main Net │ │ Linkr Net │ │
│ │ (Private) │ │ (Isolated) │ │
│ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────┘
- Use a separate VLAN or guest network
- Enable client isolation (prevents users from seeing each other)
- Apply bandwidth limits to prevent abuse
Abuse Prevention
Multiple mechanisms prevent hotspot abuse:
- Rate limiting: Per-user and per-hotspot connection limits
- Anomaly detection: Unusual patterns trigger review
- Reporting: Users can report problematic hotspots
- Suspension: Abusive hotspots are suspended pending investigation
Threat Model
We design against these threat categories:
External Threats
| Threat | Mitigation |
|---|
| DDoS attacks | CDN-based protection, rate limiting, traffic filtering |
| Credential stuffing | Rate limiting, account lockout, breach monitoring |
| API abuse | Scoped tokens, rate limiting, usage monitoring |
| Man-in-the-middle | TLS everywhere, certificate pinning |
Internal Threats
| Threat | Mitigation |
|---|
| Unauthorized access | Role-based access, audit logging, MFA for staff |
| Data exfiltration | DLP controls, access logging, separation of duties |
| Insider abuse | Least privilege, mandatory review for sensitive operations |
Network-Level Threats
| Threat | Mitigation |
|---|
| Rogue hotspots | Location verification, anomaly detection, user reports |
| Spoofed telemetry | Cryptographic authentication, consistency checks |
| Reward manipulation | Challenge-response proofs, multi-factor verification |
| Sybil attacks | Identity verification, economic incentive alignment |
Incident Response
Detection
Automated monitoring detects security events:
- Failed authentication attempts
- Unusual API usage patterns
- Anomalous telemetry data
- User reports and complaints
Response Process
- Triage: Assess severity and scope
- Contain: Isolate affected systems
- Investigate: Determine root cause
- Remediate: Fix the vulnerability
- Communicate: Notify affected users if required
- Review: Post-incident analysis and improvements
Disclosure
We follow responsible disclosure practices:
- Security issues can be reported to security@linkr.network
- Valid reports are acknowledged within 48 hours
- We don’t pursue legal action against good-faith researchers
- We provide credit in security advisories (if desired)
Compliance
Linkr maintains compliance with relevant regulations:
| Regulation | Scope | Status |
|---|
| GDPR | EU user data | Compliant |
| CCPA | California user data | Compliant |
| SOC 2 Type II | Security controls | Certified |
User Controls
Users have control over their data:
- Export: Download all your data in machine-readable format
- Delete: Request account deletion and data removal
- Opt-out: Control what analytics data is collected
- Notifications: Choose what communications you receive
Best Practices for Operators
Operators can improve security by:
- Keep firmware updated: Apply security patches promptly
- Use strong passwords: For router admin and Linkr account
- Enable 2FA: On your Linkr account
- Isolate networks: Keep Linkr traffic separate from private networks
- Monitor activity: Check your dashboard for unusual patterns
- Report issues: Alert us to any suspicious activity
Next Steps
