Video is the most sensitive data a building produces. Nevtech VMS treats it that way at every hop — encrypted in transit and at rest, isolated by tenant and by camera, and deployed on infrastructure you own and control. No shared keys. No central honeypot. No single credential that unlocks the estate.
There is no unencrypted path for video in Nevtech VMS. Live streams ride WebRTC, whose encryption is mandatory in the standard; camera-to-cloud links ride WireGuard or RTSP-over-TLS; everything the browser touches is TLS 1.3. Encryption isn't a setting an operator can forget to enable — it's the transport itself.
| Data path | How it moves | Encryption |
|---|---|---|
| Live view to operators | WebRTC (WHEP) | DTLS-SRTP |
| Two-way audio & talk-back | WebRTC (WHIP) | DTLS-SRTP |
| Tunnel & edge cameras → cloud | RTSP inside WireGuard | ChaCha20-Poly1305 |
| On-camera (ACAP) → cloud | RTSP-over-TLS (RTSPS) | TLS 1.3 |
| Console, API & signaling | HTTPS | TLS 1.3 |
| Recorded playback | HTTPS · signed URLs | TLS 1.3 |
| Camera credentials & secrets at rest | Encrypted envelope in the database | AES-256-GCM |
Nevtech VMS is split into two planes that trust each other minimally. The control plane knows who you are and what you may see. The media plane moves pixels and holds no notion of users at all — it treats every connection as hostile and asks the control plane for a decision on every session. Video bytes never flow through the component that knows your password, and the component that moves video can't be social-engineered, because it decides nothing.
The failure that ends most video platforms is one leaked credential that opens everything. Nevtech VMS is built so that can't happen — access is compartmentalized all the way down to the individual camera.
Every publishing camera and integration carries its own credential, encrypted at rest. A credential that leaks affects exactly that one camera — never another camera, never another customer, never the platform.
Every query is scoped to the acting tenant, resolved live from the user's record — not trusted from a token. One customer's cameras, users, and footage are structurally invisible to every other.
Operators can be restricted to specific sites or cameras. The limit holds everywhere — live, playback, clips, plates, health — and an out-of-scope camera returns "not found," indistinguishable from one that doesn't exist.
Watching a camera uses a 60-second, single-path token; playing a recording uses a token bound to one file. There is no durable stream URL to leak, replay, or share.
API keys and access tokens are stored only as SHA-256 fingerprints — the plaintext is shown once and never persisted. Camera passwords are AES-256-GCM encrypted. A dumped database yields no working key.
Passwords hashed with memory-hard scrypt and verified in constant time. Automatic account lockout on repeated failure. Role and suspension changes take effect on the next request, not the next login.
Nevtech VMS deploys on your own Google Cloud project, white-labeled as your platform. Your video, your recordings, and your encryption keys stay inside infrastructure you own and govern — there is no shared multi-tenant vault holding every customer's footage in one place, and no vendor back-channel to your streams.
Footage lives in your cloud storage, under your IAM, your retention rules, your region. You control your own compliance posture instead of inheriting a vendor's.
Deployments are gated by Ed25519-signed license verdicts. Access can be cut cleanly — yet recording keeps running in the background, so a commercial dispute never destroys evidence.
The media host advertises no implementation details, internal control APIs bind to loopback only, and edge sites connect outbound — so there is no inbound path into a customer's private network to defend.
Because the media plane holds no state, it scales sideways. Add a media node and cameras rebalance onto it; add a connectivity hub and gateways shard across it automatically. Storage tiers itself from fast local disk to cloud archive without an operator lifting a finger. The control plane stays lean and stateless behind a shared cache, ready to autoscale.
Each media node is an independent recorder + relay with its own buffer. Cameras reference a node; adding one is configuration, not surgery. The health picture merges across every node in real time.
Each connectivity hub carries its own address space and port pools; new gateways land on the least-loaded hub automatically. Cellular, tunnel, edge-recording, and on-camera app — one platform, every topology.
Fresh footage stays on fast local disk; older footage ages into cloud archive on a schedule, and the buffer defends itself against a full disk. Playback merges both tiers invisibly — the operator sees one continuous timeline.
We'll walk your security team through the design, hop by hop, and answer the hard questions in the demo.
Book a security review demoThis page describes the platform's security architecture. It is a statement of engineering design, not a certification. Nevtech VMS is deployed on the customer's own cloud infrastructure; responsibility for formal compliance programs (e.g. SOC 2, HIPAA, ISO 27001) attaching to a specific deployment rests with the operating organization. Contact us for architecture documentation to support your own assessment.