Direct connection
When the network allows it, media travels between Helio and the client over WebRTC without using Lume’s media relay.
DTLS-SRTPWebRTC media encrypted in transit
TLSAPI and signaling
Argon2idpassword derivation
Ed25519Helio update signatures
Where does data travel?
Relay
If the direct link fails, TURN can relay encrypted packets. The relay carries media; it does not record your video or audio sessions.
Control plane
The discovery service links the account, PC and session. APIs and signaling use TLS.
Account, device and session
- PairA pairing code links Helio to the account without exposing the account secret directly to the PC.
- AuthorizeClients use bounded session tickets; lifetime and revocation work remains tracked on the security roadmap.
- RevokeA device can be removed from the account. Revocation propagation and short-lived tickets continue to be hardened during beta.
- UpdateHelio checks the Ed25519 signature of update packages before installation.
Diagnostics and retention
- Sending a diagnostic is a voluntary tester action.
- Diagnostics target technical state—network, codecs, counters and errors—and should not contain the video or audio stream.
- The public policy describes the data categories, purposes and retention periods currently applied.
- Logs may contain technical identifiers; tokens and sensitive parameters must be redacted.
Read the privacy policy
It covers account, beta and diagnostic data as well as your rights.
What we do not claim
Verifiable security, not absolute security
Lume does not claim universal end-to-end encryption independent of the relay, a completed external security audit, or compatibility with every firewall. The beta is also used to close those gaps before broader access.
Report a security issue
Do not publish a secret or token in clear text. Contact us by email or on Discord to arrange a private channel.