1. Introduction

In today's digital landscape, hotel and casino guests expect seamless WiFi access while trusting you with their personal information. WiFiIQ understands that a security breach can damage your reputation, result in significant financial losses, and erode guest trust built over years.

This whitepaper details how WiFiIQ's security architecture, policies, and procedures work together to protect your business and your guests' data. Whether you're evaluating WiFi captive portal solutions or seeking to understand our security practices, this document provides comprehensive insights into our security framework.

2. Security Architecture Overview

WiFiIQ is built on a defense-in-depth security model that implements multiple layers of protection:

3. Data Protection

3.1 Encryption Standards

Data State	Encryption Method	Key Management
Data in Transit	TLS 1.2+ encryption for all communications	Industry-standard certificates
Data at Rest	AES-256 encryption for databases and file storage	Azure Key Vault with automated rotation
Backup Data	Encrypted backups with separate key management	Segregated access controls

3.2 Data Classification and Handling

We maintain strict data classification policies:

• Guest Personal Information: Highest protection level with restricted access
• Authentication Credentials: Encrypted and never stored in plain text
• Marketing Data: Anonymized where possible, encrypted when identifiable
• System Logs: Sanitized to remove sensitive information

4. Access Control and Identity Management

4.1 Employee Access

WiFiIQ implements strict access controls for all personnel:

• Principle of Least Privilege: Employees only have access to systems necessary for their role
• Multi-Factor Authentication (MFA): Required for all production system access
• Background Checks: All employees undergo background screening before hire
• Access Reviews: Quarterly reviews ensure access remains appropriate
• Immediate Revocation: Access removed within one business day of termination

4.2 Customer Access Management

Your administrative access to WiFiIQ is protected by:

• Unique user accounts with strong password requirements
• Role-based access control (RBAC) for different permission levels
• Session timeout after periods of inactivity
• Audit logging of all administrative actions

5. Security Monitoring and Incident Response

5.1 Continuous Monitoring

We employ multiple monitoring systems:

• Security Information and Event Management (SIEM): Real-time analysis of security alerts
• Intrusion Detection Systems: Network and host-based monitoring
• Vulnerability Scanning: Quarterly internal scans and annual penetration testing
• Performance Monitoring: Prometheus and Azure Monitor track system health

5.2 Incident Response Plan

Our comprehensive incident response plan includes:

1. Detection: Automated alerts and manual review processes
2. Assessment: Rapid triage to determine severity and scope
3. Containment: Immediate action to prevent spread or escalation
4. Eradication: Complete removal of threats and vulnerabilities
5. Recovery: Restoration of normal operations with verification
6. Lessons Learned: Post-incident review and process improvement

6. Compliance and Certifications

6.1 SOC2 Type 1 Certification

WiFiIQ has achieved SOC2 Type 1 certification as of January 20, 2025, demonstrating our commitment to:

• Security: Protection against unauthorized access and data breaches
• Confidentiality: Safeguarding of sensitive information

This certification, conducted by independent auditor Laika Compliance LLC, validates that our security controls are suitably designed to meet our service commitments.

6.2 Regulatory Compliance

Regulation	How WiFiIQ Complies
GDPR (General Data Protection Regulation)	Data minimization, consent management, right to deletion, data portability
CCPA (California Consumer Privacy Act)	Transparent data collection, consumer rights support, opt-out mechanisms
PCI DSS (Payment Card Industry)	While we don't process payments, our security standards align with PCI requirements

7. Business Continuity and Disaster Recovery

7.1 High Availability Architecture

• Redundant Systems: No single point of failure in critical systems
• Load Balancing: Automatic distribution of traffic across multiple servers
• Auto-Scaling: Dynamic resource allocation based on demand
• Geographic Distribution: Services distributed across multiple Azure regions

7.2 Backup and Recovery

Backup Type	Frequency	Retention Period	Recovery Time Objective
Database Backups	Daily	30 days	< 4 hours
Configuration Backups	Daily	90 days	< 2 hours
System Snapshots	Weekly	30 days	< 6 hours

8. Security Best Practices for Customers

8.1 Recommended Customer Security Practices

• Strong Passwords: Use complex passwords for all WiFiIQ administrative accounts
• Access Management: Regularly review and update user permissions
• Security Awareness: Train staff on phishing and social engineering threats
• Incident Reporting: Immediately report any suspected security incidents
• Software Updates: Keep integrated systems and browsers updated