Executive Summary
Coresee is an enterprise-grade unified communications platform that delivers real-time video conferencing, audio calls, screen sharing, file collaboration, and messaging across desktop, mobile, and browser clients. As organizations increasingly rely on virtual communication for mission-critical operations, the security of these platforms has become a board-level concern. This white paper provides a comprehensive overview of the security architecture, protocols, and operational practices that underpin the Coresee platform. It is intended for Chief Information Security Officers, IT security teams, compliance officers, and enterprise procurement stakeholders who require a thorough understanding of how Coresee protects sensitive communications and data. Coresee has been engineered with a security-first design philosophy that encompasses end-to-end encryption for all media streams, zero-trust network architecture, granular access controls, and continuous compliance monitoring. The platform meets or exceeds the security capabilities offered by comparable solutions, while introducing proprietary innovations in media stream isolation, real-time threat detection, and privacy-preserving analytics. Key security highlights of the Coresee platform include:- Zero-Trust Architecture: Every request is authenticated, authorized, and encrypted regardless of network location, eliminating implicit trust for any user, device, or service.
- GDPR, HIPAA, and CPRA Compliant: Built-in controls for data residency, consent management, and breach notification procedures.
- SOC 2 and ISO 27001 (In Progress): Coresee is actively pursuing SOC 2 and ISO 27001.
Platform Overview and Threat Model
Platform Architecture
Coresee can be deployed as a globally distributed microservices architecture across multiple cloud regions. Based on the customer preferences Coresee can be SAAS, hybrid mode, on premises or on the customer cloud account. The platform consists of the following core service tiers:- Client Tier: Native desktop applications for Windows and macOS, mobile applications for iOS and Android, and full-featured browser-based access.
- Edge Tier: A global network of media relay nodes and signaling servers.
- Application Tier: Stateless API services handling meeting orchestration, user management, recording, transcription, and integrations with third-party productivity tools.
- Data Tier: Encrypted-at-rest databases, object storage, and message queues partitioned by tenant and geographic region.
Threat model
To build a robust threat model for Coresee, we have to assume a “Zero-Trust” and “Zero-Knowledge” posture. Because Coresee targets high-stakes industries, the system is designed under the assumption that the network, the cloud provider, and even Coresee’s own infrastructure are fundamentally hostile or compromised. Here is the comprehensive threat model for the Coresee architecture.The Assets
- VOD & Live Media: 4K video streams, audio, and every file uploaded in the room.
- Stored Data: Recordings, compliance logs, and chat histories.
- Metadata: Who is meeting with whom, when, and for how long.
The Threat Actors
- Corporate Spies / State-Sponsored Hackers: Advanced Persistent Threats (APTs) attempting to steal manufacturing trade secrets or intellectual property.
- The “Curious Insider”: A rogue Coresee employee or a database administrator at our cloud provider trying to peek at customer data.
- Network Eavesdroppers: Man-in-the-Middle (MitM) attackers on public Wi-Fi or compromised 5G cell towers.
- Coercive Authorities: Entities issuing legal subpoenas for user data (which Coresee handles via its Zero-Knowledge design).
Attack Vectors & Coresee’s Mitigations
Vector A: Interception in Transit (The Network)
- The Threat: An attacker intercepts the packets traveling between the user and the Coresee media server.
- The Mitigation: Coresee forces the latest TLS for all signaling and API traffic. For media, WebRTC mandates DTLS/SRTP. By supporting up to the AES-256-GCM cipher suite, the intercepted network packets are mathematically useless to the attacker.
Vector B: The Server Compromise (The Insider Threat)
- The Threat: A hacker breaches Coresee’s cloud infrastructure, or a malicious operation engineer tries to view a live meeting.
- The Mitigation: For live video, Coresee utilizes WebRTC Encoded Transforms (Insertable Streams). The video is encrypted on the user’s device before it hits the WebRTC transport layer. The Coresee SFU only routes blind ciphertext; it does not possess the keys to decode the video frames.
Residual Risks
No system is 100% impervious. In a Zero-Knowledge architecture, the residual risks shift from the server to the physical world:- The Analog Hole: A participant with authorized access to a Coresee meeting simply uses their smartphone to record their laptop screen. No encryption can prevent this.
- Endpoint Keyloggers/Screen Scrapers: If a user’s device is deeply infected with OS-level malware that captures the screen buffer after the Coresee app has decrypted the video, the E2EE is bypassed.
- Rubber-Hose Cryptanalysis: An attacker physically coerces the user into tapping their physical key and unlocking the room.
Data Encryption
Encryption in Transit
All communications between Coresee clients, edge nodes, and backend services are encrypted using TLS 1.2+ with forward secrecy enabled. Legacy TLS versions (1.0, 1.1, and 1.2 without forward-secrecy cipher suites) are explicitly disabled across all endpoints. Certificate management is handled through an internal PKI backed by a hardware security module (HSM) root of trust. Media streams (audio, video, and screen share) traverse the network using SRTP (Secure Real-time Transport Protocol) with up to AES-256-GCM as the encryption algorithm depending on browser capability. SRTP keys are negotiated per session using DTLS-SRTP, ensuring that each meeting session uses a unique, ephemeral set of encryption keys that cannot be reused or replayed.Encryption at Rest
All data stored by Coresee is encrypted at rest using AES-256. This includes meeting recordings, chat messages, shared files, user profile data, and system logs. Encryption keys are managed through an envelope encryption architecture: each data object is encrypted with a unique Data Encryption Key (DEK), and each DEK is in turn encrypted by a Key Encryption Key (KEK) stored in a dedicated key management service (KMS) backed by HSMs.Authentication and Access Control
Identity and Authentication
Coresee can be enhanced with multiple authentication mechanisms to integrate seamlessly with enterprise identity providers. All authentication flows conform to industry standards including OAuth 2.0, OpenID Connect, and SAML 2.0. The platform can be enhanced with Multi-Factor Authentication (MFA) with email verification.Room Security Controls
Coresee provides a comprehensive set of controls to prevent unauthorized access to meetings:- Waiting Rooms: All external participants are held in a waiting room until explicitly admitted by the host or co-host.
- Private Meetings: Hosts can predefine all expected participants who can join, preventing any additional attendees.
- Authenticated-Only Meetings: Meetings can be configured to require all participants to authenticate with a Coresee account or a federated identity before joining.
- Unique Meeting IDs: All meetings use randomly generated, non-sequential identifiers to prevent enumeration attacks.
Media Stream Security
WebRTC and Selective Forwarding Architecture
Coresee uses WebRTC as the foundation for real-time media communication. Media streams are routed through Selective Forwarding Units (SFUs) that forward encrypted packets between participants without decrypting or mixing them. This architecture ensures that even in server-mediated topologies, the content of media streams is not accessible to the infrastructure. For multi-stream sessions (such as large meetings or webinars), the SFU layer performs intelligent bandwidth estimation and simulcast layer selection to optimize quality without requiring access to unencrypted media. Each participant sends multiple quality tiers , and the SFU selects the optimal tier for each receiver based on network conditions.Audio MCU Security
Audio mixing is performed server-side, the Audio MCU (Multipoint Control Unit) operates within a hardened, isolated compute environment. Audio data processed by the MCU is held in memory only for the duration of mixing and never persisted to disk. The MCU environment is subject to the same zero-trust policies and encryption standards as all other Coresee services.Screen Share
Screen sharing in Coresee is transmitted as an independent media stream encrypted with the same protections as video.Recording Security
Meeting recordings are subject to strict security controls. Cloud recordings are encrypted immediately upon capture using a per-recording AES-256 key and stored. Access to recordings requires authenticated access with appropriate RBAC permissions.Infrastructure and Cloud Security
Cloud Provider Security
Coresee’s production infrastructure is hosted on secure tier one cloud providers. Infrastructure is provisioned using Infrastructure as Code (IaC), with all configurations stored in version control and subject to peer review before deployment.Workload Security
All Coresee servers have this security feature- Runtime anomaly detection: Behavioral monitoring detects unexpected file changes.
Data Residency and Sovereignty
Coresee can be set up in a geographic region where their data is stored and processed. Available regions include North America, European Union, United Kingdom, Asia-Pacific. Data residency controls apply to all customer data including meeting recordings, chat messages, files, and metadata. Cross-region data transfer is prohibited.Compliance and Certifications
Coresee maintains a rigorous compliance program validated through independent third-party audits and certifications. The following table summarizes the current certification and compliance status:| Framework | Status | Scope |
| GDPR | Compliant | EU data processing, DPA available |
| HIPAA | Compliant | BAA available for healthcare customers |
| CCPA / CPRA | Compliant | California consumer privacy rights |
| SOC 2 | In Progress | All production services and infrastructure |
| ISO 27001:2022 | In Progress | Information security management system |
| CSA STAR Level 2 | In Progress | Cloud security assurance |
Incident Response and Business Continuity
Security Incident Response
Coresee maintains an incident response strategy focused on rapid engineering intervention and transparent communication. Our procedures encompass the following phases:- Preparation & Identification: Coresee utilizes continuous infrastructure monitoring and logging (including AWS security tools) to alert our engineering team to anomalous behavior or potential security events.
- Containment & Eradication: Upon identifying a potential threat, our engineering team is mobilized to manually investigate and intervene. This includes isolating affected infrastructure at the network or instance level, identifying the root cause, and neutralizing the threat.
- Recovery: Systems are restored using known-good backups and verified operational states before being reintroduced to the production environment.
- Lessons Learned: Following any significant security event, the engineering team conducts an internal review to identify infrastructure improvements and prevent recurrence.
Breach Notification
Coresee is committed to transparency and regulatory compliance in the event of a security incident. If a data breach involving customer data is confirmed, Coresee will notify affected customers promptly and within the timeframes required by applicable regulations (such as GDPR). Notifications will include the known scope of the breach, the steps our engineering team is taking to contain it, and any recommended actions for our users.Business Continuity and Disaster Recovery
Coresee leverages the inherent resilience of modern cloud infrastructure to ensure high availability and data durability. Our business continuity strategy relies on:- Cloud Infrastructure Redundancy: Coresee operates within highly reliable cloud environments (Amazon Web Services), utilizing multiple Availability Zones (AZs) within our primary region to protect against localized hardware failures.
- Routine Data Backups: To protect customer data against corruption or loss, we utilize automated, regular infrastructure snapshots and database backups.
- Disaster Recovery Operations: In the event of a catastrophic regional failure, our disaster recovery process involves provisioning new infrastructure from our standard deployment configurations and restoring data from our most recent secure backups. Our Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are scaled to align with our routine backup schedules and manual engineering deployment processes.