How Cambexa keeps your footage yours
Security isn't a page we bolt on — it's the shape of the product. Here's how we protect your cameras, your clips and your keys.
End-to-end encryption
Recordings and motion clips are encrypted on your device with AES-256 before they sync. Keys are derived from your passphrase and never leave your hardware.
Zero-knowledge storage
Our servers only ever hold opaque ciphertext. A breach of our infrastructure yields no viewable footage.
Encrypted transport
All connections use TLS 1.3. P2P streams are secured end-to-end, so live video isn't exposed in transit.
Scoped, revocable access
Shared access is granted per-camera and can be revoked instantly. No shared logins or exposed camera passwords.
Hardening & reviews
Regular dependency scanning, least-privilege services, and code review on every change to the security-critical path.
Minimal metadata
We collect the least we can to run the service, and never use your footage or behavior for advertising.
Responsible disclosure
We're grateful to security researchers who help keep Cambexa safe. If you believe you've found a vulnerability, please report it privately and give us a reasonable window to fix it before any public disclosure.
How to report
- Email security@cambexa.example with steps to reproduce.
- Include affected versions, platforms, and any proof-of-concept.
- Encrypt sensitive details with our published PGP key (placeholder).
Our commitment
- We'll acknowledge your report within 3 business days.
- We'll keep you updated on remediation progress.
- We won't pursue legal action for good-faith research that respects user privacy and avoids data destruction.
Scope
The Cambexa apps and our first-party services are in scope. Please avoid testing that degrades service for other users, accesses data that isn't yours, or targets third-party camera firmware.
Operational practices
- Least-privilege access to production, with audited, time-boxed grants.
- Encrypted backups and tested recovery procedures.
- Dependency and container scanning in CI.
- Incident response runbooks with clear user-notification commitments.
Questions about our security?
We're happy to go deep with security and compliance teams.