Security & Encryption

All video and audio calls on TelePort are protected with AES-256-GCM end-to-end encryption (E2EE) via LiveKit's built-in E2EE framework. This means the encryption key is derived on the participants' devices and is never transmitted to or known by our servers. Even TelePort cannot decrypt or listen to your consultations. Each session generates a unique encryption key that is exchanged between participants through the signaling channel.

Your calls are protected by three layers of encryption: Layer 1 — WebRTC DTLS-SRTP (AES-128) provides transport-level encryption for media streams. Layer 2 — LiveKit E2EE (AES-256-GCM) adds participant-to-participant encryption that our servers cannot decrypt. Layer 3 — TLS 1.3 encrypts all HTTPS traffic between browsers and our infrastructure. This defense-in-depth approach ensures your consultations are private at every level.

All communication between your browser and our servers is protected by TLS 1.3, the latest and most secure version of the TLS protocol. This protects all API calls, authentication data, signaling messages, and page content from eavesdropping or tampering. We enforce HTTPS across all endpoints and maintain an A+ TLS rating.

Patient data stored in PostgreSQL is encrypted at rest using the pgcrypto extension. Database backups are encrypted using AES-256. We employ strict access controls to the database layer, with network isolation and least-privilege IAM policies. Encryption keys are managed separately from the data they protect.

We use NextAuth.js v5 with credential-based authentication. Passwords are hashed with bcryptjs (12 rounds). Two-factor authentication (TFA/MFA) support is built-in and can be enabled per account. Role-based access control (RBAC) ensures providers can only access their own patients' information. Session tokens expire after 8 hours of inactivity, and an auto-lock feature secures inactive sessions after 15 minutes. All authentication attempts are logged in our immutable audit trail.

TelePort is designed from the ground up for PHIPA (Ontario), PIPEDA (Federal), PIPA (Alberta/BC), and HIPAA (US) compliance. We maintain Business Associate Agreements with all service providers. Regular security assessments and penetration tests are conducted by independent third-party firms. Our compliance documentation is available to enterprise customers under NDA.

All patient data is stored exclusively on Canadian servers hosted with Canadian cloud providers. Video and audio are routed through our Canadian-hosted LiveKit Selective Forwarding Unit (SFU). Data never leaves Canada. This is a core architectural requirement, not an afterthought — we maintain Canadian data residency by design.

Every access to personal health information is recorded in an immutable audit log. Each entry captures: who accessed the data, what action was taken, which resource was affected, the timestamp, the IP address, and the user agent. Audit logs cannot be modified or deleted — they provide a permanent, verifiable record of all PHI access for compliance and security monitoring.

Sessions are automatically locked after 15 minutes of inactivity. Session tokens expire after 8 hours regardless of activity. Users are logged out when they close their browser. All sessions use HTTP-only, secure, SameSite cookies to prevent cross-site request forgery (CSRF) and cross-site scripting (XSS) attacks.

Our application runs in isolated Docker containers with least-privilege user accounts (non-root). Regular security updates are applied automatically. The database is network-isolated from the public internet. LiveKit runs as a separate service with its own authentication. Redis is used only for session caching (no PHI stored). All infrastructure is monitored 24/7 with automated alerting for suspicious activity.