Security

NEXORA is built with security as part of the architecture, not an afterthought. Here’s what’s true today, and what’s coming next.

Available today

Non-guessable meeting links

Meeting IDs are generated with high entropy from a restricted alphabet. The internal database identifier for a meeting is never exposed in a URL.

Hashed passwords

Account passwords and optional meeting passwords are hashed with Argon2 — never stored, logged, or transmitted in plain text.

Short-lived access tokens with rotating refresh

Sessions use short-lived JWT access tokens paired with refresh tokens that rotate on every use and can be revoked individually.

Host-enforced meeting controls

Waiting rooms, meeting locking, and participant removal are enforced on the server — not just hidden in the interface.

Encrypted transport

Signaling and media connections run over encrypted transports (HTTPS/WSS and DTLS-SRTP for media).

Security-relevant audit logging

Actions like login, registration, and administrative changes are recorded in an append-only audit log.

On the roadmap

These are architected for but not yet available — we’d rather tell you they’re coming than claim they’re already here.

  • Multi-factor authentication (MFA)
  • Single sign-on (SSO) via SAML and OIDC for organizations
  • End-to-end encrypted meetings
  • Third-party security review and certifications

Found a security issue?

Please report it through the Contact page rather than a public channel, so it can be addressed before wider disclosure.