TR EN
Demo
Home > Security
Secure Platform

RfidSpace security rules

RfidSpace treats security as a full lifecycle practice across RFID, RTLS, BLE, IoT, PDKS, access control and ERP integrations.

Rules Security Model FAQ Demo
RfidSpace security rules for secure RFID platform
Security overview

Security from tag to report

This page summarizes the secure application development principles used by RfidSpace in platform design, implementation and operation. The wording is adapted for RfidSpace workflows and does not replace a customer-specific security policy or legal assessment.

RfidSpace security rule set

Secure development baseline

Development work is evaluated against information security management principles and current web application risk models.

  • OWASP risk classes are reviewed during design and code review.
  • Security expectations are defined before new modules, integrations or mobile workflows go live.
  • Changes affecting authentication, authorization, tenant data or reporting are handled as high-impact changes.

Input validation and parameter control

All data coming from forms, handhelds, readers, gateways, APIs and integrations is validated on the server side.

  • Allow-list validation is preferred for tenant codes, EPC values, device identifiers, dates and operation types.
  • Client-side checks are used only for usability; authorization and validation decisions are enforced on the server.
  • Manipulated route, query and form parameters cannot grant access to another asset, document or tenant record.

Identity, session and authorization

Users, service accounts, devices and integrations are authenticated before they can create operational records.

  • Role, branch, warehouse, store, department and tenant scopes determine which records can be viewed or changed.
  • Least-privilege access is applied for administrators, operators, handheld users and API clients.
  • Session timeout, token lifetime and device registration policies are configured according to project risk.

Multi-tenant data isolation

RfidSpace separates tenant data at the application, API and reporting layers to prevent cross-customer visibility.

  • Every operational event is processed with tenant context.
  • Reports, dashboards, searches and exports apply tenant and role filters consistently.
  • Integration jobs cannot read or write records outside their assigned customer scope.

Data protection and cryptography

Sensitive data is identified, minimized, protected in transit and protected at rest where the project architecture requires it.

  • HTTPS/TLS is required for user interfaces, mobile synchronization, device gateways and API endpoints.
  • Sensitive keys, connection strings and API keys are kept outside source code and managed as protected configuration.
  • Personal data used in PDKS, visitor and access control workflows is processed with purpose limitation and auditability.

API and integration security

ERP, WMS, POS, HR, PLC, Modbus and IoT integrations use controlled endpoints and explicit data contracts.

  • Inbound requests are validated for identity, tenant, schema, operation type and expected payload size.
  • Rate limiting, replay protection and restricted service credentials are planned for public or partner-facing APIs.
  • Integration errors expose operational status, not stack traces, database details or sensitive values.

Logging, audit and incident readiness

RfidSpace turns critical actions into traceable records so operational and security events can be reviewed later.

  • Login attempts, failed authorization, data changes, exports, device reads and integration jobs are logged according to project scope.
  • Abnormal traffic, repeated failures or unexpected device behavior can be evaluated as security signals.
  • Operational logs support troubleshooting without revealing sensitive information to unauthorized users.

Operational security controls

Deployment and maintenance practices are handled with secure configuration, backup, update and review discipline.

  • Production, test and development environments are separated.
  • Dependencies, frameworks and operating components are reviewed for known vulnerabilities.
  • Backup, restore and access review processes are defined for business-critical deployments.

Where these rules are applied

RFID and barcode operations

Receiving, counting, dispatch, asset assignment and store workflows are checked with user, device, tenant and location context.

PDKS and access control

Attendance, visitor and access events are handled with authorization, audit trail and personal data minimization principles.

IoT and RTLS telemetry

Gateway, beacon, sensor and Modbus readings are validated before being converted into dashboard, alert or integration events.

Frequently asked questions

Does RfidSpace support tenant-based authorization?

Yes. Tenant context, role rules and location scopes are used together in multi-customer or multi-location deployments.

Are device and API records auditable?

Critical reads, integration jobs and user actions can be logged with user, device, time and operation context.

Is this page a legal compliance guarantee?

No. It explains the RfidSpace security approach. Customer-specific compliance, KVKK/GDPR and audit requirements must be assessed per project.