End-to-End Encryption
Every voice call and video stream on HiLink is protected by end-to-end encryption (E2EE). This means only the call participants can hear or see the content — not HiLink, not our servers, and certainly not any third party.
AES-256 Audio
Audio streams are encrypted using AES-256-GCM before leaving your device.
SRTP Video Streams
Video frames are encrypted using SRTP (Secure Real-time Transport Protocol).
Key Exchange (ECDH)
Encryption keys are negotiated via Elliptic Curve Diffie-Hellman — never stored on our servers.
Every Call Has a Traceable Identity
A unique security code is displayed on every live call screen. Even if someone photographs your screen with another device, the code reveals who was on the call — our team can act immediately.
No call is anonymous to our safety team
Each security code is cryptographically tied to the session participants and timestamp. If a screenshot of a call is ever shared or reported, the code lets our moderation team instantly identify who was involved and take action.
Multi-Layer Architecture
HiLink is built as a layered system where each tier has a specific responsibility and trust boundary. No single layer has total access — a breach at one layer cannot cascade into the others.
Client Layer (Mobile App)
Handles UI rendering, local encryption key management, biometric authentication, and media capture. The app encrypts all data before sending to the network.
API Gateway Layer
All API calls pass through an authenticated gateway that validates JWT tokens, enforces rate limits, and blocks malformed requests before they reach backend services.
Microservices Layer
Independent services for auth, media routing, payments, and moderation. Each service owns its data and communicates over internal encrypted channels only.
Real-Time Media Layer (WebRTC)
Live voice and video travel peer-to-peer via WebRTC with STUN/TURN relay fallback. Media never touches our application servers — only encrypted metadata for signaling.
Data Storage Layer
Encrypted-at-rest databases with strict access control lists. Database credentials are rotated automatically and never exposed to application code directly.
WebRTC Real-Time Communications
HiLink's voice and video calling is powered by WebRTC — the open standard for real-time peer-to-peer media. This approach minimises latency, reduces server load, and keeps your call content private.
Peer-to-Peer Priority
Whenever network conditions allow, media flows directly device-to-device. Your voice and video packets never touch HiLink's servers.
TURN Relay Fallback
When direct P2P is blocked by firewalls or NAT, encrypted media is relayed via our TURN servers — still encrypted end-to-end.
Adaptive Bitrate
HiLink's media engine adapts video resolution and bitrate in real time based on available bandwidth, ensuring smooth calls on 2G/3G/4G networks.
Noise Suppression
Built-in AI noise suppression and echo cancellation algorithms filter background sounds for crystal-clear audio quality on every call.
Secure Token Authentication (JWT)
HiLink uses JSON Web Tokens (JWT) for stateless, secure API authentication. Every session is cryptographically signed and time-limited — there are no long-lived passwords flying across the network.
Data Residency
User data is stored in geographically distributed data centres with regional residency compliance. HiLink does not move data across jurisdictions without explicit legal basis.
- Indian user data is stored on servers located within India, compliant with IT Act and DPDP Act requirements.
- Backups are encrypted and stored in isolated vaults separate from primary production systems.
- Data centre access is restricted by physical security, multi-factor authentication, and audit logging.
Secure Server Infrastructure
HiLink's backend runs on hardened cloud infrastructure with security-first configuration at every level of the stack.
DDoS Protection
Always-on volumetric attack mitigation with automatic traffic scrubbing.
WAF (Web Application Firewall)
Filters SQL injection, XSS, and OWASP Top 10 threats at the edge.
Automated Vulnerability Scanning
Daily automated scans detect misconfigurations and CVEs in our dependencies.
24/7 Security Monitoring
SIEM-based alerting triggers automated and human response to anomalies.