Security

How Cambexa keeps your footage yours

Security isn't a page we bolt on — it's the shape of the product. Here's how we protect your cameras, your clips and your keys.

End-to-end encryption

Recordings and motion clips are encrypted on your device with AES-256 before they sync. Keys are derived from your passphrase and never leave your hardware.

Zero-knowledge storage

Our servers only ever hold opaque ciphertext. A breach of our infrastructure yields no viewable footage.

Encrypted transport

All connections use TLS 1.3. P2P streams are secured end-to-end, so live video isn't exposed in transit.

Scoped, revocable access

Shared access is granted per-camera and can be revoked instantly. No shared logins or exposed camera passwords.

Hardening & reviews

Regular dependency scanning, least-privilege services, and code review on every change to the security-critical path.

Minimal metadata

We collect the least we can to run the service, and never use your footage or behavior for advertising.

Template notice. This page describes a representative security posture for this template. Replace it with your product's verified practices, and have security counsel review before publishing.

Responsible disclosure

We're grateful to security researchers who help keep Cambexa safe. If you believe you've found a vulnerability, please report it privately and give us a reasonable window to fix it before any public disclosure.

How to report

  • Email security@cambexa.example with steps to reproduce.
  • Include affected versions, platforms, and any proof-of-concept.
  • Encrypt sensitive details with our published PGP key (placeholder).

Our commitment

  • We'll acknowledge your report within 3 business days.
  • We'll keep you updated on remediation progress.
  • We won't pursue legal action for good-faith research that respects user privacy and avoids data destruction.

Scope

The Cambexa apps and our first-party services are in scope. Please avoid testing that degrades service for other users, accesses data that isn't yours, or targets third-party camera firmware.

Operational practices

  • Least-privilege access to production, with audited, time-boxed grants.
  • Encrypted backups and tested recovery procedures.
  • Dependency and container scanning in CI.
  • Incident response runbooks with clear user-notification commitments.

Questions about our security?

We're happy to go deep with security and compliance teams.