Security Architecture

Authenticator apps are widely considered the gold standard for personal and business security because they eliminate the "telecom link" in your security chain. Unlike SMS, which transmits sensitive codes over unencrypted cellular networks vulnerable to SIM swapping and interception (like the 2024 Salt Typhoon breach), an authenticator app generates Time-Based One-Time Passwords (TOTP) locally on your device's hardware. This means even if a hacker hijacks your phone number through your carrier, they still cannot access your accounts because the "secret key" used to generate your codes never leaves your physical MacBook or phone.

Furthermore, authenticator apps provide a level of reliability and privacy that SMS cannot match. Because the codes are generated mathematically using the current time and a shared secret, they work perfectly offline—whether you’re in a basement with no signal or on an international flight—without the latency or "delivery failed" issues common with international SMS gateways. For a developer or business owner managing multiple entities, this method also protects your privacy by ensuring you don't have to share your personal mobile number with every service you use, effectively closing a common vector for tracking and social engineering.

The client links use HMAC-SHA256 cryptographic signing, which means each token is signed with a server-only secret so any change to the token contents invalidates it immediately. The payload is also time-limited and validated server-side before access is granted.

This architecture is materially safer than collecting documents through email attachments because access is controlled at every step, rather than relying on documents being forwarded, downloaded, and stored across multiple inboxes and devices. Clients upload into a restricted system using signed, time-limited links, and staff access is governed by authenticated roles and server-side checks instead of whoever happens to possess an email thread.

It is also safer because the documents are not simply attached to messages and copied around indefinitely. Files are stored in locked-down cloud storage, metadata and permissions are kept separately, and file access is issued only when specifically authorized, using short-lived access tokens. That sharply reduces the risk of uncontrolled duplication, accidental forwarding, and long-term exposure through old email archives.

The platform also provides much stronger visibility and control than email. Access can be revoked, links can expire, sessions can be restricted, activity can be logged, and records can be tied to a single business and application context. With email attachments, once a document is sent, control is largely lost; with this architecture, access remains managed, time-bound, and auditable throughout the document collection process.