Security and data

Recording, object detection, and appearance search run locally. External communication depends on the features you configure: notifications, webhooks, an optional AI provider, update checks and downloads from the EverNVR release server, and the detector packages fetched during installation.

Network access

The recorder serves HTTPS and WSS from its first start, with a certificate from its own certificate authority that it reissues by itself when its address changes. Install that CA on each device before entering real credentials; the login page has the steps and the fingerprint to check. A site with its own CA can serve a certificate from it instead, loaded at startup and renewed with a restart (see HTTPS). Plain HTTP on the same port only redirects to HTTPS or hands out the CA, and responses over HTTPS carry Strict-Transport-Security for 180 days so a browser that has reached the recorder over HTTPS keeps doing so.

EverNVR is intended for the site's LAN. A public-origin setting supplies links for messages; it does not establish a tunnel or off-site access. Limit host network access to the clients and integrations that need it.

Accounts and credentials

There is no default login. Camera permissions are enforced by the server for media, events, and live feeds. Export permission is separate from camera access. API tokens inherit the owning account's permissions; revocation closes their open streams and feeds.

Camera and provider secrets are encrypted with the recorder's secret.key. The configuration backup contains that key alongside the database. A permanent owner can set a backup passphrase under Settings → Backups; every backup then carries the key wrapped under it and a restore asks for the passphrase. Without one, the key travels in clear and anyone who can read a backup can recover its stored credentials; the settings will not save until the owner accepts that in so many words, and the acceptance is in the account history. Keep backups on access-controlled encrypted storage either way. Losing the key, or the passphrase, prevents credential recovery.

Every sign-in attempt is recorded with its outcome, the username as typed and the source address, as is every API token the recorder refuses; the record is kept for 90 days. API tokens are minted and revoked only by a signed-in owner administrator, never by another token.

Media and sharing

Host administrators and anyone with direct access to recording storage are outside the browser's permission boundary. Protect raw recordings, exported files, and media backups separately. Privacy masks are applied wherever a picture leaves the recorder: masked pixels in every snapshot, still, clip and frame, and a browser-only overlay on live video, which is why a masked camera's live video socket is refused to API tokens. Masks do not change what another recorder receives directly from the camera.

Email may send event images to the configured mail relay. Push messages carry text only, encrypted end to end to each subscribed device, and pass through that device's push service (Apple, Google, Mozilla, or Microsoft). The optional AI agent sends selected pictures and context to its configured endpoint. Review these destinations and camera selections during customer handoff.

Support bundles are redacted diagnostics; configuration backups are sensitive recovery material. Use the right artifact for the task. See accounts, privacy masks, and recovery.