Security and data

• SRTP with AES-256-GCM, the keys agreed over DTLS, on every connection that can do it.
• A device without GCM falls back to AES-128, and its panel says so rather than hiding it.
• Admin → Live shows the cipher for everyone on air.
• The media server forwards audio without decoding or mixing it. Two things do open it, because their job needs it: a mic test line, to play your own take back to you, and a line connected to a desk or Dante, to play it out.

• Cloud sites are HTTPS all the way: to our edge, and from there to the server.
• Passwords are kept only as bcrypt hashes. Ten wrong ones in a row rest an account for 15 minutes.
• Each site signs its own sign-ins with a secret of its own, so a sign-in from one site is no use at another.
• One device per person: a second device signing in as someone already on air is refused.
• Stream Deck keys are per person, and shown covered in Admin.
• On ON Comms Server, browsers use HTTPS with the server’s own certificate. The phone apps sign in to it over plain HTTP on the venue network — the audio is still encrypted — so keep the server on a private network, or use the cloud if that matters to you.

• A database of your own and a signing secret of your own, for every cloud site.
• Inside your site, our staff see how many users, groups and people on air there are — never who.
• Every night’s backup is sealed with AES-256-GCM, under a key kept apart from the data.
• A setup you save is encrypted with your passphrase (scrypt and AES-256-GCM); without it, the file shows nothing.

• Talkback audio. It is not recorded or written to disk. A mic test line holds your own take in memory only long enough to play it back to you.
• Link quality. Each panel’s readings are held in memory for 20 seconds, for Admin → Live, and never written down.
• An endless log. The activity log is capped, so it cannot grow for ever.

The privacy notice sets out everything we hold, and why.

• A licence check-in, once a week.
• Update checks, for the signed feed.
• The list of crew apps that Admin → Downloads shows.
• If you allow connections from the internet, a question to Google’s public STUN server, when it starts and every five minutes, to learn the server’s own public address.