Security
How ISN Free WiFi protects tenant and guest data across the Platform. Last updated 6 August 2026.
Tenant data isolation
Every tenant's data — guest records, portal configuration, billing, analytics — is stored with row-level security policies enforced at the database itself, not just checked in application code. Each tenant's data is logically isolated from every other tenant and is not reachable by another tenant through the dashboard or API, regardless of which captive portal a request comes through.
Encryption
| Area | How it's protected |
|---|---|
| Data in transit | HTTPS/TLS enforced across the Platform, including HTTP Strict Transport Security so a browser never falls back to an unencrypted connection once it's visited. |
| Passwords | Hashed, never stored in plain text. Business Account and guest passwords alike are irreversibly hashed before they ever touch a database row. |
| Stored credentials | Any third-party credential a tenant supplies (a payment gateway secret key, their own outgoing email password) is encrypted at rest with AES-256-GCM before storage, decrypted only in-memory at the moment it's actually used. |
| Card payment details | Never touch our own servers. Card payments are processed directly through our payment processor's own hosted checkout — we only ever see a transaction result, not the card number itself. |
Access control & support access
ISN Free WiFi staff never ask a tenant for their dashboard password — not by phone, not by email, not in support chat. When a tenant asks us for hands-on help (for example, configuring a router), our staff access that dashboard through a separate, audited internal support mechanism tied to the staff member's own ISN Free WiFi account, never the tenant's. Every such access is logged distinctly from a tenant's own ordinary logins, so it's always clear after the fact who accessed what, and why.
Actions performed through router management and remote CLI tools are recorded in an audit log tied to the account and IP address that performed them — configuration changes on a tenant's router are always traceable back to a specific actor and moment, not anonymous.
Application security practices
- Rate limiting on public and sensitive endpoints — login, signup, password reset, and every form reachable without an account — to blunt automated abuse and credential-stuffing attempts.
- Session and one-time-use tokens (password resets, device sign-in links, team invites) are cryptographically signed and either short-lived or single-use, never a guessable sequence.
- Incoming webhooks from our payment processor are verified against a cryptographic signature before anything in a request is trusted or acted on.
- User-supplied content is escaped before being placed into emails or rendered pages, to guard against injection.
Availability
We publish live uptime and incident information on our status page, and document what tenants can expect from us in our Service Level Agreement.
Sub-processors
We use a small set of specialist providers to run the Platform — database hosting, application hosting, SMS and email delivery, and payment processing. What each category is used for is listed in Section 6 of our Privacy Policy.
Compliance & certifications
We operate with POPIA (South Africa's Protection of Personal Information Act) in mind across the Platform, as described in our Privacy Policy. In the interest of being straightforward rather than overselling: ISN Free WiFi does not currently hold a formal third-party security certification such as SOC 2 or ISO 27001. If a specific certification matters for your organization's own procurement requirements, contact us and we'll let you know honestly where things stand.
Reporting a security issue
If you believe you've found a security vulnerability in the Platform, please report it to info@isnfreewifi.co.za with enough detail to reproduce it. We ask that you give us a reasonable opportunity to investigate and address a report before disclosing it publicly, and that you avoid accessing, modifying, or deleting data that isn't your own while testing. We don't currently run a paid bug bounty program, but we take every genuine report seriously and will acknowledge it.