Security & data processing
How Evidentum treats accounts, camera-derived data, evidence, and AI features. Written to match the product — not aspirational marketing.
Your tenant, your data
Cameras, incidents, cases, and evidence belong to your organization. Data is scoped by tenant; roles and site scoping further limit access. We don’t sell customer investigation content. By default we don’t use Customer Content to train general-purpose AI models.
What we process
- Account and auth data (sessions; password hashes server-side)
- Billing metadata via Stripe (cards stored by Stripe)
- Camera Data: RTSP streams → frames, thumbnails, clips (detection/AI designed not to process audio)
- Events, incidents, cases, evidence, custody metadata, exports
- AI text context when enabled — not raw video files in current product paths
- Audit and operational security logs
Full categories: Privacy Policy.
Authentication & access control
- Email/password auth; SSO on eligible plans
- RBAC permission checks on API routes
- Site scoping for location-limited Users
- Invites and admin role management in-product
- Production refuses weak/default JWT and worker tokens, and demo DB passwords
Media & evidence
Clips and thumbnails are served through authenticated / signed media paths — not a public open bucket. Evidence custody and audit tooling help record who accessed investigation artifacts. Insurance/police/executive packages are Customer-controlled exports, not automatic submissions to third parties.
Encryption & Cloud network posture
- TLS for app and API hostnames in production
- Postgres/Redis kept off the public internet
- Production Redis requires authentication
You remain responsible for RTSP credentials, camera networks, and User endpoints.
Application security
- Rate limiting on sensitive endpoints
- Stripe webhook signature verification before plan changes
- OpenAPI docs disabled by default in production
- Gated metrics/health where tokens are configured
- Demo seed refused when APP_ENV=production
AI subprocessors
When AI Features are on, we may send text prompts and investigative metadata to providers such as OpenAI. Current paths are designed not to upload raw video binaries. Outputs are investigative aids (Known / Likely / Action / Unable) — not identity or legal determinations. See Subprocessors and the DPA.
Automation
Playbooks can notify integrations and, if you connect access control, request physical actions. High-impact steps support approval gates. You configure and authorize those systems. Evidentum is not an emergency monitoring bureau.
Retention, holds, deletion
Plan entitlements and compliance settings affect retention. Legal holds can preserve data. Deletion is commercially reasonable — not always instantaneous (backups, holds, legal retention). Details in Privacy and the DPA.
Logging & incidents
Org-scoped audit logs cover security-relevant actions. If Customer Personal Data is affected by a Security Incident, our DPA commits to notify you without undue delay. Keep admin contacts current.
What we do not claim
- No SOC 2 / ISO / FedRAMP claim unless completed and listed here
- No “military-grade” or “unhackable” language
- No guarantee of perfect detection or prevention
- No guarantee Evidence is court-admissible
- Not a substitute for professional security or emergency services
Responsible disclosure
Email security@evidentum.ai with a description, repro steps, and contact info. Don’t test on tenants you don’t own, and don’t run destructive DoS without written approval.
Enterprise review
Questionnaires and DPAs: Contact Sales. Legal: Terms, Privacy, DPA, Acceptable Use.
Full working draft: docs/legal/05-security-disclosure.md