NEXORA is built with security as part of the architecture, not an afterthought. Here’s what’s true today, and what’s coming next.
Non-guessable meeting links
Meeting IDs are generated with high entropy from a restricted alphabet. The internal database identifier for a meeting is never exposed in a URL.
Hashed passwords
Account passwords and optional meeting passwords are hashed with Argon2 — never stored, logged, or transmitted in plain text.
Short-lived access tokens with rotating refresh
Sessions use short-lived JWT access tokens paired with refresh tokens that rotate on every use and can be revoked individually.
Host-enforced meeting controls
Waiting rooms, meeting locking, and participant removal are enforced on the server — not just hidden in the interface.
Encrypted transport
Signaling and media connections run over encrypted transports (HTTPS/WSS and DTLS-SRTP for media).
Security-relevant audit logging
Actions like login, registration, and administrative changes are recorded in an append-only audit log.
These are architected for but not yet available — we’d rather tell you they’re coming than claim they’re already here.
Found a security issue?
Please report it through the Contact page rather than a public channel, so it can be addressed before wider disclosure.