​
Security Best Practices

1

1. Secure Token Management

API tokens are used to authenticate your requests to Edge, and it’s crucial to handle them securely:
  • Store Tokens Securely: Use environment variables or a secure vault for storing your tokens. Avoid hardcoding tokens directly into your codebase.
  • Rotate Tokens Regularly: Periodically rotate your tokens to reduce the risk of unauthorized access.
  • Limit Token Scope: Issue tokens with the minimum permissions necessary for your use case.
If a token is exposed or compromised, revoke it immediately through the Edge Dashboard to prevent unauthorized access.
2

2. Use Data Encryption

Edge supports AES 256-bit encryption for securing data transfers in the production environment:
  • Encrypt Sensitive Data: Ensure that any personal or financial information is encrypted before it’s sent to Edge.
  • Include Encryption Headers: When making API calls, add the X-Encryption-Type: AES256 header to indicate that the request is encrypted.
  • Use TLS/HTTPS: All API requests to Edge should use TLS (Transport Layer Security) to encrypt data during transmission, ensuring it cannot be intercepted.
Data encryption protects your sensitive information both in transit and at rest, reducing the risk of data breaches.
3

3. Implement Strong User Authentication

Ensure that both internal users (e.g., administrators) and external users (e.g., customers) are authenticated securely:
  • Use Multi-Factor Authentication (MFA): Require MFA for all admin access to the Edge Dashboard.
  • Enforce Strong Passwords: Implement password policies that require a combination of letters, numbers, and special characters.
  • Monitor Login Attempts: Track failed login attempts and consider implementing account lockout mechanisms to prevent brute-force attacks.
Weak authentication can expose your integration to unauthorized access. Always require strong passwords and MFA for secure access.
4

4. Monitor and Log API Activity

Regularly monitoring your API activity helps you detect and respond to suspicious behavior:
  • Enable API Logs: Use the Edge Dashboard to enable detailed logging of API requests, responses, and errors.
  • Set Up Alerts: Create alerts for abnormal activities like repeated failed login attempts, unusual transaction volumes, or access from unknown IP addresses.
  • Regularly Review Logs: Perform periodic reviews of API logs to ensure that no unauthorized activity has occurred.
API logging and monitoring provide visibility into how your integration is being used, allowing you to take action quickly if an issue arises.
5

5. Implement Incident Response Procedures

Preparing for potential security incidents helps minimize the impact on your business and users:
  • Define an Incident Response Plan: Create a plan that outlines the steps to take if a security incident occurs, including whom to notify and how to contain the issue.
  • Train Your Team: Ensure that your team is trained on the incident response procedures and knows how to use the tools available for security monitoring.
  • Conduct Regular Drills: Run regular security drills to test your incident response plan and improve your team’s readiness.
A slow or ineffective response to a security incident can result in significant data loss and damage to your reputation.

​
Key Security Features

  • AES 256-Bit Encryption: Ensures that sensitive data is protected when transferred between your systems and Edge.
  • API Logging: Provides detailed insights into API usage, helping you monitor access and detect suspicious activity.
  • Multi-Factor Authentication (MFA): Adds an extra layer of security for accessing sensitive areas like the Edge Dashboard.
Following these security best practices will help you protect your integration with Edge and maintain the trust of your users.

​
Security Tips for Developers

Use environment variables or secure vaults for storing API keys and secrets, keeping them out of source code repositories.
Regularly audit your API keys and user access levels to ensure that no unnecessary permissions are granted.
Remember to update your encryption keys periodically and monitor access logs for any unusual activity to maintain a secure integration.

​
Common Security Risks to Avoid

  • Exposed Tokens: Accidentally exposing tokens in public repositories can result in unauthorized access to your API. Always use .env files or secure storage solutions.
  • Weak Authentication: Not enforcing strong passwords or MFA can lead to unauthorized access. Implement robust authentication mechanisms for all users.
  • Failure to Monitor API Activity: Without proper logging and monitoring, you may not detect unauthorized access until it’s too late. Always enable and review logs.
Neglecting security practices can put your business and your users’ data at risk. Always prioritize security when integrating with Edge.