Below is what reviewers usually ask about first. You can verify each item on a test setup during the test connection.
Access and accounts
- Passwords: Argon2id, NIST and OWASP requirements (12 characters or more), checked against the HIBP breach database
- JWT sessions: 24 hours and 7 days, with a refresh token blacklist
- A role model with six roles, self-escalation of privileges is blocked
- Self-registration is disabled: accounts are created by the organization’s administrator
- Rate limits on sensitive operations: 5 sign-in attempts per minute, 10 PIN entries per minute
Channel
- HTTPS is mandatory, HSTS for one year, secure cookies, protection against CSRF, XSS and clickjacking
- WebSocket connections are opened only after authentication, using short-lived tickets (60 seconds) so identifiers do not leak through proxy logs
- Server-side validation of the output channel: nobody can connect to someone else’s language channel
- The viewer PIN has six digits and is not embedded in the QR code
Audit trail and observability
- Append-only access log for protected recordings
- Tokens and PINs are masked in logs
- Monitoring: Prometheus (30 days), Loki (7 days), Grafana with alerts, health checks with automatic restart
Data
Where servers, recordings and backups are hosted, see Where data and recordings are stored.
Need a package for a specific procurement or security questionnaire? Write to us via the form and list the sections your regulations require: we will answer each item directly, including those where the answer is no.