Try it free

Security and privacy

What creekX does to protect your video, your people and your viewers, and where its limits are today.

Certification

creekX has no formal certification (such as ISO 27001 or SOC 2), and no independent penetration test has been done yet; one is planned. Everything below is a product feature checked by our own automated tests, not a formal approval.

Encryption

  • In transit: HTTPS for the app and video, certificates renewed automatically; SRT ingest encrypted with AES and a passphrase per stream; WebRTC media always encrypted (DTLS-SRTP).
  • Secrets: stream keys, camera passwords and other credentials are sealed with AES-256-GCM, and never written to logs.
  • Backups: encrypted with AES-256-GCM on your server before they leave it.
  • Limit: recordings and library videos are stored unencrypted on your disks. Use disk encryption (for example LUKS) if you need encryption at rest.

Access control

  • Roles for people (owner, admin, operator, viewer) and API keys.
  • Camera access per site, enforced by the server.
  • Workspaces kept apart by the database itself (PostgreSQL row-level security).
  • Viewers: signed watch links, one-time viewer tokens, IP allow-lists and blocks, and an optional check by your own system before every stream and viewer; if it does not answer, access is refused.
  • Rate limits on sign-in, sign-up and password reset; guards against internal-address requests.
  • Limit: two-factor sign-in is not built in yet. Use single sign-on with your own provider's two-factor.

See Who may watch and stream.

Logs

  • A viewer log: who watched, from which device and address, and when.
  • An audit log of administrative actions, hash-chained so changes can be detected.
  • Both stay on your server.

Offline and private

  • Offline installer, offline upgrades, and a signed licence file checked on your server.
  • No telemetry: creekX sends nothing to us. Every outbound connection it can make is an optional feature you turn on.
  • Your video, recordings and data stay on your servers.

Single sign-on

OpenID Connect, which providers such as Microsoft Entra ID, Okta, Google Workspace and Keycloak offer. Limits: SAML is not supported, and so far sign-on is tested against a test provider, not each provider by name.