Security
How your calls are protected
A transparent description of the security model. If you find a vulnerability, please tell us through the contact page.
Encrypted media
All audio and video use WebRTC with DTLS-SRTP. Keys are negotiated between the two browsers.
Peer-to-peer by default
Media goes browser to browser. A TURN relay, if used, forwards encrypted packets it cannot read.
Unguessable rooms
Room IDs come from a cryptographic random generator with roughly 49 bits of entropy.
Temporary state
Signaling data is held in memory and deleted when rooms expire. No database, no logs of calls.
Hardened transport
HTTPS and WSS only, strict Content Security Policy, HSTS and other security headers.
Abuse protection
Rate limiting per IP and per connection, input validation, and origin allow-listing.
Signaling
The signaling server exists only to introduce two browsers. It validates every message, relays only session descriptions and ICE candidates, and routes them by the connection's own room membership, so a client cannot address peers outside its room or impersonate another participant. Each participant receives a random peer ID and a private reconnect token; both are discarded when the room closes.
Room links
A room link is a capability to join, not a form of authentication. Anyone with the link can join while the room is open, which is why rooms are limited to two participants and expire automatically. Room pages are excluded from search engines and the site sends a no-referrer policy so links do not leak through browser headers.
Browser permissions
The app never requests the camera or microphone without a click. The Permissions-Policy header restricts device access to this site's own origin, and the page cannot be embedded in other websites.
Recording
Recording is a local browser feature. It is always visible to you (red indicator and timer) and announced to the other participant over the encrypted peer connection. Files are never uploaded.
Operators
Lumen Call is open for self-hosting. Operators should terminate TLS at a reverse proxy, configure an allow-list of origins, and provide a TURN server with short-lived credentials for networks that block direct connections. The server issues TURN credentials only to participants who have successfully joined a room.