Built to be trusted with real footage
Security camera footage is sensitive by definition — it can show your home, your business, your staff, your customers. Here's exactly what protects it, on the device, in the platform, and in how we run the company behind it.
On the device
Every install, whether a Hub appliance or the Windows app — all of this runs by default, not as a paid add-on.
Local-first storage, always
Footage, camera credentials, and accounts are stored on the device itself — the Hub on site, or the Windows machine running NVRblink. There's no mandatory cloud account and no NVRblink server your footage passes through by default. Cloud storage is an optional, clearly-labelled backup add-on, never the primary copy.
Encrypted at rest
Camera passwords and other stored credentials are encrypted on disk, never held in plain text. Login passwords are hashed with BCrypt, not stored or transmitted in a recoverable form.
Tamper-evident audit log
Every login, setting change, and camera edit is written into a SHA-256 hash-chained audit trail. Alter a past entry and the chain breaks — built to make silent tampering detectable, not just logged after the fact.
Two-factor authentication
Standard TOTP-based 2FA (Google Authenticator, Authy, and similar apps) for admin sign-in, with one-time recovery codes if a device is lost.
Account lockout & hardened by default
Repeated failed sign-ins lock an account out for a cooldown period. The Hub itself runs with fail2ban, a host firewall, an SSH on/off toggle, and automatic security updates — hardened from the moment it's plugged in, not something an installer has to remember to configure.
Cameras isolated on their own network
The Hub's second network port, with its own built-in DHCP, keeps every camera off a client's actual network entirely. No IP conflicts, nothing for their IT provider to worry about, and a compromised or misbehaving camera physically cannot reach anything else on site.
Remote access, on your terms
Remote access is off until it's deliberately turned on. When it's on, every device gets a free hostname so remote access survives an IP change, and the Hub can manage a genuine trusted HTTPS certificate via Let's Encrypt automatically if pointed at your own domain — or use a self-signed certificate with the apps pinning it on first connection, the same trust-on-first-use model SSH uses for host keys.
On the partner & customer portals
The same discipline applied to every account that can reach a device remotely.
Separate credentials for every audience
Customers, resellers, staff, and field engineers each authenticate through entirely separate, isolated login systems — a compromised login in one never grants access to another. Reseller and engineer accounts lock out after repeated failed attempts, the same as every other account on the platform.
Ownership checked on every request
Every API call is scoped to what the signed-in account actually owns — a reseller can only ever see their own clients, sites, and devices; an engineer only the sites they've been assigned. Accessing something outside that scope returns "not found," not an error that confirms it exists.
Short-lived, single-purpose credentials
Remote engineer access to a live site is granted through a short-lived, single-use token tied to one verified session, not a shared password — a typical grant-to-verify round trip completes in around a second, and the credential is worthless the moment it's used.
Rate-limited and lockout-protected
Every login and password-reset endpoint on the platform is rate-limited per IP address, on top of the account-level lockout above — a real, tested defence against automated password guessing, not just a checkbox.
Data protection & company
UK company, UK data, UK ICO registration
NVRblink is a trading name of Creswick Media Ltd, a company registered in England and Wales, registered with the Information Commissioner's Office (ICO registration ZC157455). Development, hosting, and support are all handled in-house in the UK — nothing outsourced overseas.
No tracking on this site
This website runs no tracking cookies and no analytics pixels. What little is collected — a contact form submission, ordinary server logs — is exactly what it looks like, nothing more.
You control what's kept
Account data can be reviewed, corrected, or deleted through self-service tools in the customer and partner portals — you're never dependent on a support ticket to exercise a right you already have under UK GDPR.
Honest about what isn't guaranteed
We'd rather tell you plainly where a security model has a real limitation than oversell it — see the full breakdown on the apps page for exactly what mobile session storage does and doesn't protect against, for example.
Want the legal detail?
Read the full privacy policy, or get in touch if you have a specific question about how we handle data.