TLS 1.2+, DTLS-SRTP, RBAC with 30+ permissions, 2FA, dynamic privacy masks, SHA-256 evidence locks, and a complete audit trail. Built into Visylix from day one, not bolted on as an add-on.
Talk to SecurityNo legacy ciphers, no plaintext fallbacks, no shortcuts. Security by configuration, not by remembering.
TLS 1.0 and 1.1 disabled outright. Strong cipher suites only, on every external endpoint, dashboard, API, WebSocket, and stream egress.
Every WebRTC media stream encrypted with DTLS-SRTP using ECDSA P-256 certificates. Sub-second latency without weakening transport security.
Dashboard, API, and admin surfaces refuse plaintext HTTP. HSTS preloaded. Certificates auto-rotate when deployed against ACME providers.
Only ports 80/443 exposed at the edge. Microservices speak over a private network with mTLS optional, with no path for an external client to reach internals directly.
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a strict Content-Security-Policy on every response. Closes whole classes of web attacks by default.
Defense in depth from the IdP to the RTSP socket. Every gate has a lock.
Stateless JWT auth with configurable expiry on every API and dashboard session. Easy revocation through short-lived access + refresh pairs.
Camera RTSP connections use Digest auth, never Basic. Credentials never traverse the network in the clear, even on legacy ONVIF cameras.
10 failed logins inside 15 minutes triggers an automatic lockout. Configurable thresholds. Stops credential stuffing without locking out real users.
Token-bucket limits at the gateway protect login, API, and stream endpoints from DoS, brute force, and noisy integration bugs alike.
Passwords stripped from every RTSP URL the moment they hit logs, errors, or API responses. Camera passwords never leak through observability tooling.
Webhook payload signatures compared in constant time. No timing oracle on shared secret verification, even under load.
Plug Visylix into the IdP and second-factor system you already operate. No extra password vault.
SAML 2.0 and OIDC out of the box. Okta, Azure AD, Google Workspace, Auth0, JumpCloud, and any standards-compliant IdP. Centralized lifecycle, group-to-role mapping, and just-in-time provisioning.
Learn about SSOTOTP authenticator apps, WebAuthn passkeys, and recovery codes. Per-user enrollment, admin-enforced MFA policies per role, and lockout protection that survives a lost device.
Learn about MFA + PasskeysFour predefined roles, 30+ permissions. Everyone gets what they need, nothing more.
| Role | Live view | Recordings | Camera config | AI config | System settings |
|---|---|---|---|---|---|
| Super Admin | Full | Full | Full | Full | Full |
| Admin | Full | Full | Full | Full | Full |
| Operator | Full | Full | Full | View only | No |
| Viewer | View only | Playback only | No | No | No |
Masking, sovereignty, and retention built in from day one, not retrofitted under audit pressure.
Black out arbitrary polygonal regions in live and recorded footage. Mask configuration is per-camera, multi-zone, and editable without downtime.
Masks are applied before frames leave the server. No client-side bypass, no clever DevTools tricks, no privacy regressions when a viewer client misbehaves.
Footage and metadata stay inside your network. No mandatory cloud round-trip. Useful for GDPR, NIS2, India DPDPA, and locales with strict data-export rules.
Fully operational without internet after initial install. AI inference, streaming, recording, and management run locally. Works in classified, OT, and isolated industrial networks.
Per-camera or global retention policies with automatic cleanup. Aligns with data-minimization obligations and storage budgets without manual purges.
Privacy masks, retention policies, audit trails, and on-premise deployment combine into the workflow that compliance teams actually sign off on.
Bookmarks, hashes, and chain-of-custody so footage holds up the day a lawyer asks for it.
Bookmark a clip with headline, description, six color-coded priorities, and freeform tags. Pick a precise time range, no clicking through frames blind.
Search across every camera and every day by tag. Surface "incident-2026-014" or "loading-dock" instantly without scrubbing terabytes.
Locked clips skip the nightly retention sweep. They survive even when older than your retention window. Only admins can release a lock.
Hash sealed when the lock applies, verified on every subsequent access. A single byte change breaks the chain, tampering becomes provable.
Who locked, when, and why. Every share and access stamped with timestamp, IP, and user agent. Exportable as a court-ready bundle.
Lock indefinitely or until a specific date. Re-lock and extend without losing the original chain. Built for litigation hold workflows.
Encryption, validation, and audit logging stacked together. One control failing does not compromise the rest.
Camera passwords, integration tokens, and API keys stored under AES-256 (Fernet). Master key lives outside the database. Compromise of the DB alone does not expose secrets.
Tunable per-route body-size caps stop oversized-payload DoS, runaway uploads, and accidental memory exhaustion from misbehaving clients.
All filesystem-touching paths normalized and confined to allowlisted roots. No "../" tricks, no escape from media or evidence directories.
Cross-origin requests confined to declared origins. Production warns loudly on permissive wildcards instead of letting them silently ship.
CSP restricts script sources, frame ancestors, connect targets, and inline execution. XSS and injection have nowhere to land.
Every authenticated action recorded with timestamp, IP, user agent, and full payload diff for sensitive ops. Streamable to your SIEM.
Free 7-day trial, no credit card. Self-hosted, air-gap, or hybrid, your call.