Encryption
- All public endpoints are served over TLS 1.2+ with HSTS.
- The primary database and recordings both sit on Cloudflare (D1 and R2) and are encrypted at rest by the provider.
- OAuth tokens and other secrets stored in our database are encrypted with an application-layer key.
Access control
- The database is not reachable from the public internet. It is bound to our API service and has no other network path, so every read and write passes through an authenticated, authorised request.
- Authorisation is checked per request against the signed-in account, and sessions can be revoked centrally.
- No database credential of any kind is shipped to the browser or the mobile apps.
- Administrative actions are audited.
Network
- All traffic terminates at Cloudflare with WAF and DDoS protection.
- LiveKit media servers run on isolated per-room VMs and are torn down after each session.
- Egress from media servers is limited to the customer R2 bucket and the platform control plane.
Vulnerability management
- Dependencies are continuously scanned via GitHub Dependabot.
- Static analysis (Semgrep) runs on every change.
- Critical issues are patched within 72 hours of disclosure where feasible.
Incident response
Suspected security incidents are triaged within one business hour. Confirmed incidents affecting customer data trigger notification to affected customers within 72 hours, in line with our DPA.
Reporting a vulnerability
Found something? Email security@mobinars.com. Please do not publicly disclose until we have had a reasonable opportunity to investigate and patch. We acknowledge reports within two business days.