We use the Messaging Layer Security (MLS) for end-to-end encryption. MLS constantly changes the keys used to encrypt data sent between the camera and the app. Therefore, even if the camera or app is ever compromised and keys that are used at that time are stolen, they cannot be used to decrypt any your videos in the past or future. These properties are called “forward secrecy” and “post-compromise security.”

We use Rust to program all our software in the camera and part of the software in the app that is in charge of encryption. Rust is a memory-safe language and using it significantly reduces the chances of having a vulnerability in the code that could be exploited by attacker to take over the camera or the app.

A common practice to safeguard updates is to require a digital signature. In addition to that, our camera will soon also require the updates to be made available publicly in an immutable cloud storage space (with at least a one year retention policy). This way, all updates released to our cameras can be easily accessed and analyzed by users and security analysts.

Updates released to our cameras and our app are in the binary form. To make the analysis of our updates easier, we make our builds of our camera software (and in the future our app) reproducible, allowing analysts to verify that the binary updates are compiled from our source code available publicly in our Github repository.