All the coms runs over https or wss and access is controlled by tokens that can be invalidated.

But security is a big issue in this area. If you have any suggestions on what we should be doing then it would be great to have some input.