Below is what reviewers usually ask about first. You can verify each item on a test setup during the test connection.
Access and accounts
- Passwords: Argon2id, NIST and OWASP requirements (12 characters or more), checked against the HIBP breach database
- JWT sessions: 24 hours and 7 days, with a refresh token blacklist
- A role model with six roles, self-escalation of privileges is blocked
- Self-registration is disabled: accounts are created by the organization’s administrator
- Rate limits on sensitive operations: 5 sign-in attempts per minute, 10 PIN entries per minute
Channel
- HTTPS is mandatory, HSTS for one year, secure cookies, protection against CSRF, XSS and clickjacking
- WebSocket connections are opened only after authentication, using short-lived tickets (60 seconds) so identifiers do not leak through proxy logs
- Server-side validation of the output channel: nobody can connect to someone else’s language channel
- The viewer PIN has six digits and is not embedded in the QR code
Audit trail and observability
- Append-only access log for protected recordings
- Tokens and PINs are masked in logs
- Monitoring: Prometheus (30 days), Loki (7 days), Grafana with alerts, health checks with automatic restart
Data
Servers, recordings and backups are in Russia, details in Where data and recordings are stored.
Need a package for a specific procurement or security questionnaire? Write to us via the form and list the sections your regulations require: we will answer each item directly, including those where the answer is no.