CockpitShop Platform Security

API Credential Protection

Your Dirs21 API key is encrypted with AES-256 immediately upon entry into our system. The key is stored in encrypted form in a database that is inaccessible from the public internet. Even CockpitShop staff cannot retrieve your API key in plain text — only the encrypted value is stored, and decryption occurs only in isolated, memory-secure processes when a module performs an API call.

Transport Security

All communication between your browser and CockpitShop uses TLS 1.2 or higher with modern cipher suites. All communication between our modules and the Dirs21 API is likewise encrypted. We enforce HSTS (HTTP Strict Transport Security) with a minimum max-age of 365 days.

Account Access Security

CockpitShop uses passwordless magic link authentication, eliminating the risk of password theft, credential stuffing and password reuse attacks. Magic links are single-use, expire after 15 minutes, and are cryptographically signed. Session tokens are rotated on every page load and expire after 4 hours of inactivity.

Infrastructure

Our infrastructure is hosted exclusively within the European Economic Area. Database servers are not directly accessible from the internet. All access to production infrastructure requires multi-factor authentication and is logged. Infrastructure is managed with configuration-as-code and automated vulnerability scanning runs weekly.