Transport
Node-to-orchestrator uses TLS with mutual authentication on port 443. The node dials out. Local admin is a separate listener on 8443 and should stay on the site network.
Where video lives
Continuous record is written on the edge node. The orchestrator relays playback; it is not a second vault we ask you to trust with every frame.
Licences
Keys are node-locked. Step 1 of licensing emails an activation code, never a key. See licensing.
What this document is not
It is not a SOC 2 report or a PCI certificate. It is the trust model you can send a questionnaire against. Email sales if you need that answered formally.