Security

In the software

• Footage encrypted at rest. Every clip is encrypted with AES-256 on the machine that records it. The key never leaves that machine.
• Footage sealed against alteration. Each clip carries an HMAC-SHA256 seal. A clip changed on disk is refused at playback and export.
• No default password. The first administrator is created during setup. Passwords are stored with PBKDF2 at 600,000 rounds.
• Remote access is operate-only. The web interface has no route that deletes cameras or footage, or changes configuration. The restriction is in the server, not in hidden buttons.
• Encrypted web interface. TLS 1.2 or 1.3 only, a strict content security policy, and no framing by other sites.
• Limits on the network surface. Connections per address, request timeouts and sign-in rate limits.
• Untrusted input checked. Addresses from camera discovery are validated before they reach the recording engine.
• Everything logged. Every sign-in, arm, disarm and change is recorded with who made it.

On this website

• Passwords are stored as salted PBKDF2 hashes. Session and email-link tokens are stored only as SHA-256 hashes.
• Card details go to Paddle and never reach JDX Security.
• Licences are signed offline. The signing key is never on a server.
• Downloads are served over HTTPS to confirmed accounts only.

Report a problem

Email security@jdxsecurity.com with:

• the version and platform affected,
• the steps to reproduce the problem, and
• what an attacker could do with it.

Expect a reply within three business days. A confirmed problem is fixed as a priority, released free to every customer, and credited in the update log if you wish.

Research in good faith is welcome. Test only on your own installation and your own account. Do not access other people's data, run denial-of-service tests, or use social engineering. Give a reasonable time to fix a problem before publishing it.

Machine-readable contact: security.txt.