Security architecture

Security built into
the architecture.
Not bolted on.

Video is the most sensitive data a building produces. Nevtech VMS treats it that way at every hop — encrypted in transit and at rest, isolated by tenant and by camera, and deployed on infrastructure you own and control. No shared keys. No central honeypot. No single credential that unlocks the estate.

AES-256-GCM at rest DTLS-SRTP · TLS 1.3 · WireGuard in transit Per-camera credentials Per-tenant isolation Your cloud, your keys
Encrypted end to end

Every stream is encrypted on the wire — by protocol, not by policy.

There is no unencrypted path for video in Nevtech VMS. Live streams ride WebRTC, whose encryption is mandatory in the standard; camera-to-cloud links ride WireGuard or RTSP-over-TLS; everything the browser touches is TLS 1.3. Encryption isn't a setting an operator can forget to enable — it's the transport itself.

Data pathHow it movesEncryption
Live view to operatorsWebRTC (WHEP)DTLS-SRTP
Two-way audio & talk-backWebRTC (WHIP)DTLS-SRTP
Tunnel & edge cameras → cloudRTSP inside WireGuardChaCha20-Poly1305
On-camera (ACAP) → cloudRTSP-over-TLS (RTSPS)TLS 1.3
Console, API & signalingHTTPSTLS 1.3
Recorded playbackHTTPS · signed URLsTLS 1.3
Camera credentials & secrets at restEncrypted envelope in the databaseAES-256-GCM
Zero-trust media plane

The system that moves the video can't be talked into leaking it.

Nevtech VMS is split into two planes that trust each other minimally. The control plane knows who you are and what you may see. The media plane moves pixels and holds no notion of users at all — it treats every connection as hostile and asks the control plane for a decision on every session. Video bytes never flow through the component that knows your password, and the component that moves video can't be social-engineered, because it decides nothing.

Control plane

Decides access

  • Authenticates users & re-checks their role on every request
  • Issues 60-second, single-path stream tickets
  • Enforces tenant & per-user camera boundaries
  • Never carries a single frame of video
→ ticket →
Media plane

Moves pixels only

  • Holds no users, no tenants, no long-lived credentials
  • Calls the control plane to authorize every publish and view
  • A stolen ticket expires in a minute and works for one camera
  • Horizontally scalable and independently replaceable
Isolated by design

No master key. Every camera, every tenant, its own boundary.

The failure that ends most video platforms is one leaked credential that opens everything. Nevtech VMS is built so that can't happen — access is compartmentalized all the way down to the individual camera.

Per-camera credentials

One key, one room

Every publishing camera and integration carries its own credential, encrypted at rest. A credential that leaks affects exactly that one camera — never another camera, never another customer, never the platform.

Per-tenant isolation

Organizations never bleed

Every query is scoped to the acting tenant, resolved live from the user's record — not trusted from a token. One customer's cameras, users, and footage are structurally invisible to every other.

Per-user visibility

Least privilege, live

Operators can be restricted to specific sites or cameras. The limit holds everywhere — live, playback, clips, plates, health — and an out-of-scope camera returns "not found," indistinguishable from one that doesn't exist.

Short-lived tickets

Nothing you hold lasts

Watching a camera uses a 60-second, single-path token; playing a recording uses a token bound to one file. There is no durable stream URL to leak, replay, or share.

Secrets, hash-only

A database leak hands over nothing

API keys and access tokens are stored only as SHA-256 fingerprints — the plaintext is shown once and never persisted. Camera passwords are AES-256-GCM encrypted. A dumped database yields no working key.

Hardened identity

Credentials that resist attack

Passwords hashed with memory-hard scrypt and verified in constant time. Automatic account lockout on repeated failure. Role and suspension changes take effect on the next request, not the next login.

Data sovereignty

It runs on your cloud. Your footage never becomes someone else's asset.

Nevtech VMS deploys on your own Google Cloud project, white-labeled as your platform. Your video, your recordings, and your encryption keys stay inside infrastructure you own and govern — there is no shared multi-tenant vault holding every customer's footage in one place, and no vendor back-channel to your streams.

Your infrastructure

You hold the keys

Footage lives in your cloud storage, under your IAM, your retention rules, your region. You control your own compliance posture instead of inheriting a vendor's.

Cryptographic licensing

Signed, revocable, honest

Deployments are gated by Ed25519-signed license verdicts. Access can be cut cleanly — yet recording keeps running in the background, so a commercial dispute never destroys evidence.

Minimal attack surface

Nothing exposed by default

The media host advertises no implementation details, internal control APIs bind to loopback only, and edge sites connect outbound — so there is no inbound path into a customer's private network to defend.

Built to scale

From one site to thousands of cameras — horizontally, by plane.

Because the media plane holds no state, it scales sideways. Add a media node and cameras rebalance onto it; add a connectivity hub and gateways shard across it automatically. Storage tiers itself from fast local disk to cloud archive without an operator lifting a finger. The control plane stays lean and stateless behind a shared cache, ready to autoscale.

~250
cameras per media node
(rule of thumb)
Horizontal
media nodes & hubs
shard automatically
Hot → Cold
self-tiering storage,
days to years of retention
Cloud-native
stateless API,
autoscale-ready
Media-node pooling

Grow by adding nodes

Each media node is an independent recorder + relay with its own buffer. Cameras reference a node; adding one is configuration, not surgery. The health picture merges across every node in real time.

Connectivity sharding

Thousands of remote sites

Each connectivity hub carries its own address space and port pools; new gateways land on the least-loaded hub automatically. Cellular, tunnel, edge-recording, and on-camera app — one platform, every topology.

Self-tiering storage

Retention without babysitting

Fresh footage stays on fast local disk; older footage ages into cloud archive on a schedule, and the buffer defends itself against a full disk. Playback merges both tiers invisibly — the operator sees one continuous timeline.

See the architecture, not just the slides.

We'll walk your security team through the design, hop by hop, and answer the hard questions in the demo.

Book a security review demo

This page describes the platform's security architecture. It is a statement of engineering design, not a certification. Nevtech VMS is deployed on the customer's own cloud infrastructure; responsibility for formal compliance programs (e.g. SOC 2, HIPAA, ISO 27001) attaching to a specific deployment rests with the operating organization. Contact us for architecture documentation to support your own assessment.