How We Secure Ively SmartEye™ | Enterprise Mobile Security

Security & Trust

How Ively SmartEye™ protects your organization

Enterprise-grade security for mobile surveillance

Ively SmartEye™ is built for organizations that cannot afford unauthorized access to cameras, alerts, or AI detections. Every layer — mobile app, API, cloud processing, and notifications — is designed so only authenticated users inside your tenant can view data permitted by your administrator.

TLS 1.2+ only (production) Certificate pinning Encrypted token storage Biometric unlock Role-based access Tenant isolation

Document purpose: Customer demo & security overview | Product: Ively SmartEye™ Mobile | Last updated: July 11, 2026

1. Security at a glance

Your surveillance data never flows through a public, anonymous channel. Authorized users sign in with credentials (and optional MFA) issued by your organization. The mobile app communicates only with https://api.ivelytech.com over encrypted HTTPS. Detections, alerts, and video metadata are scoped to your customer account — other organizations on the platform cannot see your sites, cameras, or incidents.

User login Password + optional MFA

→

Secure session JWT stored in Keychain / Keystore

→

Pinned TLS api.ivelytech.com only

→

Tenant API Your data only

→

Alerts & media Role-filtered results

2. Mobile app security (how we implement it)

Encrypted credential storage

Authentication tokens and sensitive identifiers are stored in the platform secure enclave — iOS Keychain and Android Keystore via Flutter Secure Storage. They are not saved in plain-text app preferences.

Certificate pinning (production)

Production builds pin the SHA-256 hash of the API server certificate for api.ivelytech.com. A man-in-the-middle proxy or fake certificate cannot intercept login or API traffic.

No cleartext HTTP

Android production builds disable cleartext traffic. All API, login, MFA, and media requests use HTTPS/TLS.

Biometric app lock

Optional fingerprint or Face ID unlock re-authenticates the user on cold start and after auto-lock. Biometric templates never leave the device and are not sent to Ively servers.

Release hardening

Android release builds use ProGuard/R8 code shrinking and obfuscation. Environment secrets (API URL, SSL pins) are bundled per build flavor — not hardcoded in source.

Safe logging

Production logs sanitize passwords, tokens, and PII. Crash reports go to Firebase Crashlytics without exposing session secrets.

3. App screenshots — security in practice

Below are views from the Ively SmartEye™ mobile application. Replace or extend these images with your own demo screenshots as needed (save under assets/img/security/).

Ively SmartEye secure app splash screen — Branded secure entry

Secure login screen — Authenticated login

Biometric unlock

Device-only authentication

Face ID / Fingerprint

Auto-lock after idle

Session stays encrypted

No password stored on device

Biometric protection

Unlock without re-entering password

Secure connection

Production API

TLS encrypted

Certificate pinned

api.ivelytech.com

Bearer token per request

Pinned API channel

Third parties cannot impersonate our server

4. How AI detections stay secure

AI detections (fire/smoke, fall, theft, people, vehicles, PPE, and more) are processed in your organization's deployment context. The mobile app does not expose a open API to the internet for third parties.

Control	What it means for your organization
Tenant isolation	Every API request is tied to your authenticated session and customer ID. Users only receive alerts, incidents, and cameras assigned to their account.
Role-based permissions	Features such as audit logs, incident reports, and module screens are gated by server-side permissions — the app hides what your role cannot access.
Authenticated media	Thumbnails, snapshots, and video clip URLs require a valid session token. Anonymous hotlinking from outside the app is blocked.
Push notification scoping	FCM/APNs device tokens are registered to your customer account after login. Alerts are routed only to devices subscribed for your organization.
Session expiry	Expired or revoked sessions are rejected by the API (HTTP 401). The app prompts re-login — stale tokens cannot browse detections.
Evidence download policy	Incident downloads respect user preferences (e.g. block large transfers on mobile data) and use the same authenticated channels as the rest of the app.

Can a third party access our detections?
No — not without valid credentials issued by your administrator. There is no public “browse all cameras” endpoint. Attackers with only network access cannot decrypt TLS traffic when certificate pinning is enabled. Attackers without your login cannot obtain JWT tokens. Other Ively customers cannot query your tenant's data.

5. Secure deployment architecture

API endpoint: https://api.ivelytech.com/api/v1 — TLS-terminated, production certificate pinned in mobile release builds.
Environment separation: Development, staging, and production use separate configuration bundles so test builds cannot accidentally target production data.
Firebase (push & crashes): Google Firebase Cloud Messaging delivers notifications; Crashlytics collects anonymized crash diagnostics — configured per environment.
On-premise / private cloud: Enterprise deployments can align API base URLs and media hosts with your infrastructure while keeping the same mobile security controls (TLS, pinning, secure storage).
Legal & compliance: See our Privacy Policy and Terms of Service for data handling and enterprise responsibilities.

6. What your administrators control

User provisioning and de-provisioning (access ends when accounts are disabled)
Which sites, cameras, and detection modules each user can see
Notification categories and critical-alert policies
Retention and export policies for incident data (per your agreement)
Compliance with local surveillance and privacy laws for camera placement and signage

7. Security layers summary

Layer	Technology	Protects against
Transport	HTTPS / TLS 1.2+	Eavesdropping on the wire
Pinning	SHA-256 cert pin (production)	Fake certificates / MITM proxies
Authentication	JWT + optional MFA	Unauthorized users
Device storage	Keychain / Keystore	Token theft from device backup
App lock	Biometric + auto-lock	Physical device misuse
Authorization	Server-side RBAC	Horizontal access across tenants
Binary	ProGuard (Android release)	Reverse engineering of app logic

8. Responsible disclosure

If you discover a security concern, contact info@ivelytech.com with subject line Security Report — SmartEye. We investigate verified reports and coordinate fixes with affected customers.

Ready for a secure demo?

See Ively SmartEye™ live with your use case — fire & smoke, people analytics, fall detection, and real-time alerts on mobile.

Request a Demo Contact Sales

Watch. Analyze. Grow