Trust & Security

Our commitment

SeeItLive carries live camera streams and snapshots that often originate from your customers. We take that responsibility seriously. This page describes the controls we have in place — aligned with the OWASP Top 10, the industry-standard reference for application security risks.

Authentication & access control

Every API call and console action passes through our authorization layer. Sessions are tied to the authenticated account and can be reviewed and revoked at any time from your account settings.

Sign-in options include password, passkeys, and one-time magic links. API keys are scoped per account and can be revoked at any time. Session records and snapshots are visible only to authenticated members of the workspace that owns them.

Encryption

Passwords are stored exclusively as bcrypt hashes — never in plaintext, never reversibly encrypted. TOTP two-factor secrets are encrypted at rest. API keys and recovery codes are stored as hashes and shown only once at creation.

All traffic to seeitlive.io and our API is served over TLS, with HTTP Strict Transport Security (HSTS) enforced in production. Live video runs over DTLS-SRTP, the encryption WebRTC mandates for peer-to-peer media.

Cryptographic tokens (session identifiers, magic-link tokens, recovery codes) are generated using Node.js cryptographic primitives.

Authenticated session signaling

Live sessions are negotiated over an authenticated real-time signaling channel. Each participant — agent and guest — is admitted only with a valid, single-use session credential, so a join link cannot be replayed or used to enter an unrelated session.

Once negotiated, the video and audio flow peer-to-peer between the guest's device and the agent's browser; SeeItLive relays only the signaling needed to establish the connection, and does not record the stream.

Multi-factor authentication

We support multiple second factors:

• TOTP (Google Authenticator, 1Password, Authy, etc.), with the secret encrypted at rest
• Passkeys / WebAuthn (Touch ID, Face ID, Windows Hello, hardware security keys)
• SMS one-time codes
• Recovery codes (single-use, hashed at rest)

Repeated failed second-factor attempts trigger a per-account lockout to blunt brute-force attacks. Passwords must be at least 8 characters and are checked against the Have I Been Pwned breach corpus — known-compromised passwords are rejected at registration and at password reset.

Input validation & injection prevention

All inbound requests are validated against strict schemas before reaching business logic. Database access goes exclusively through a query builder with parameterized statements — no raw SQL is concatenated with user input, eliminating an entire class of SQL injection vulnerabilities.

Uploaded snapshots and attachments are validated against a MIME-type allowlist and a maximum file size.

Browser-side defenses

Every page response carries a Content Security Policy that locks down which scripts, styles, and connections the browser will execute or open. Inline scripts run only with a per-request cryptographic nonce; arbitrary script injection is blocked even if it bypasses output-encoding (XSS, a malicious browser extension, a compromised CDN).

The same response also sets HSTS (transport security), frame-ancestors (prevents clickjacking via iframe), base-uri, and form-action restrictions.

Rate limiting & abuse prevention

Authentication and public endpoints have aggressive per-IP rate limits (for example, 5 login or registration attempts per minute, and the public contact form is capped as well). The API as a whole is rate-limited to deter enumeration and denial-of-service.

reCAPTCHA scores public-facing forms (registration, login, contact). Suspicious-login detection flags anomalous IP/device patterns and triggers a security email to the account owner. Multi-account abuse signals are evaluated at registration time.

Live media & snapshots

The live camera stream is transmitted peer-to-peer and is never recorded by SeeItLive. Only the snapshots an agent chooses to capture are stored, and each capture is written to the session's audit trail.

Stored snapshots are bound to the workspace that owns the session and are accessible only to its authenticated members. Guests grant camera access explicitly in their browser and can end sharing at any time.

Audit logs & monitoring

Security-relevant events are logged with timestamp, IP address, and user agent: successful and failed logins, MFA enrollment and removal, session creation and revocation, password resets, and API key changes. Account owners can review their own audit log from the console.

Application logs are structured (JSON) and retained for diagnostic and incident-response purposes.

Unhandled application errors are captured by a separate error-tracking system. Before any event is transmitted, authorization tokens, cookies, and session identifiers are stripped from request headers, request bodies for authentication and account-security routes are redacted, sensitive query parameters are removed, and user context is limited to a stable account identifier — never email, name, or phone.

Infrastructure & configuration

SeeItLive is hosted in Canada. Standard security headers (HSTS, secure cookie flags, cross-origin policies) are set on every response. Error responses are sanitized — stack traces and internal error details are never returned to clients. Dependencies are pinned via lockfile and reviewed before each update.

Responsible disclosure

We welcome reports from security researchers. If you believe you have discovered a vulnerability in SeeItLive, please contact us through our contact form (topic: Security) before public disclosure. We commit to acknowledging reports within 5 business days and will work with you on a coordinated disclosure timeline. We do not currently operate a paid bug bounty program, but we are happy to credit researchers in our release notes.

Contact

For security questionnaires, due-diligence requests, or to discuss a specific control in more depth, please use our contact form and select the Security topic. We respond to security inquiries within 2 business days.