Video in transit
The application and supported video paths use encrypted transport. HTTPS protects the application and video delivery, WebRTC media uses DTLS-SRTP, and SRT ingest can use AES encryption with a separate passphrase for each stream.
Security
Security and privacy controls for video on your servers
Before approving a self-hosted streaming system, you need to know where video goes, who can watch it and what evidence supports its controls. CreekX provides encrypted transport, access controls, viewer and administrative logs, and an offline deployment option. This page also sets out the limits that matter during a security review.
The deployment boundary starts with your infrastructure
CreekX runs on servers controlled by the customer. Video, recordings, credentials and logs are stored there, and CreekX sends no telemetry to CreekX. The product can also operate without an internet connection when installed with the offline package and licence supplied through sales. Optional features and integrations can create outbound connections when the customer enables them. These connections are documented, and a complete list is available on request.
How data is protected
Credentials and secrets
Stream keys, camera passwords and other stored credentials are sealed with AES-256-GCM. They are not stored as plain text or written to application logs.
Off-site backups
When an off-site backup is enabled, CreekX encrypts it with AES-256-GCM on the customer’s server before it leaves that server. Enabling this feature creates an outbound data path controlled by the customer.
Recorded and library files
Recorded video and library files are stored without built-in file encryption on the customer’s disks. Organisations requiring encryption at rest must provide disk encryption on the server.
Access control and separation
People and API access
CreekX provides owner, admin, operator and viewer roles, along with API keys. Camera access can be limited by site so each person sees only the sites assigned to them.
Protected viewing
Viewing can be controlled with signed watch links, one-time viewer tokens, IP allow-lists and blocks. CreekX can also ask the customer’s own system to approve a stream or viewer; if that system does not answer, access is refused.
Workspace isolation
Separate workspaces are isolated through database-enforced row-level security, rather than relying only on checks in the application.
Session protection
CreekX uses secure sign-in sessions, applies rate limits to sign-in, sign-up and password-reset requests, and includes protection against requests to internal network addresses.
Viewer and administrative records
Viewer connection logs record who watched, the device and IP address used, and when the connection occurred. Administrative actions are recorded in an audit log linked by a hash chain so later alteration can be detected. These records remain on the customer’s server.
Identity controls and current limits
CreekX supports single sign-on through OpenID Connect. Testing so far has used a test identity provider in automated tests rather than validating every third-party identity service. Built-in two-factor authentication is not currently available, but an organisation can use its own identity provider to enforce two-factor authentication. SAML is not supported.
Current assurance status
CreekX does not currently hold a formal security certification, and no independent penetration test or external audit has been completed. An external penetration test is planned. The product controls described on this page have been checked through CreekX’s own automated tests; that testing is not an independent approval or a determination of regulatory compliance.
Information available for your review
Public documentation covers viewer security, single sign-on, backups and licensing. CreekX can also provide a list of the product’s possible outbound connections for teams reviewing an offline or restricted-network deployment.
- Viewer-security and access-control guidance
- Single sign-on guidance
- Backup and licence documentation
- Outbound-connection list available on request
Choose the right evaluation route
You can start a 14-day Media Server trial without a credit card. Its installer needs internet access during installation, and the trial does not include the CreekX Cameras portal. Contact CreekX first if you need Cameras, a fully offline or air-gapped installation, tender information, several servers, more than 50 live streams, or Enterprise terms. You can describe the problem even if you are not yet sure about protocols, server size or architecture.