Introduction

This page describes the information security policy for Agora products. The following figure shows the Agora security architecture:

../_images/security_en.png

Purpose

Agora is committed to safeguard the confidentiality, integrity, and availability of all physical and electronic information assets.

Scope

This information security policy describes how Agora protects the customer data properly with security controls:

  • Confidentiality against unauthorized access and eavesdropping

  • Integrity against tampering, forgery, and replay

  • Availability using the Agora Global Network

Data Classification

All customer data is classified according to the following policy and protected accordingly. This policy applies to data in all formats or media.

Agora categorizes the customer data in the following ways:

Category Description
Customer Account Data User information required to manage the customer account with Agora. This includes the email address of the account administrator, company name, company URL, and Dashboard Access Log entries.
End User Data

All end-user level data such as logins, identities, and payment information.

This data is not shared with Agora.

Conversation Content Media contents are encrypted on the end devices, and the Agora Cloud does not have any key to decrypt them.
Operational Health Metrics

Other data generated by the Agora servers when accessing the Agora Cloud, including:

  • Media Server Logs
  • Analytics Data

Security Standards

The following security standards are applied to protect the customer data within Agora’s control.

Data Encryption

The Agora channel is encrypted with the AES-128 or AES-256 algorithm between clients and the client/server.

Data Transmission

Transmission Service

  • No Single Point: Agora has multiple server rooms providing services globally. The service is not affected if any server room is down.

  • Regional Isolation: All edge nodes are deployed geographically, and the user will only connect to the edge room in the local region. Services in other regions will not be not affected if the server rooms of a region are down.

  • Rapid Recovery: If a server room is under attack, Agora provides special tools to help rebuild and recover the services within 30 minutes.

  • Secure Routing Services: Agora uses routing services to improve the communication quality and enhance the user experience. The Agora Cloud does not have any key to decrypt any media content during the transmission. The media contents can only be decrypted on the end devices with customer authorized keys, including the Client App and Agora Recording Server (ARS).

Transmission Scheduling

Before the Agora SDK accesses the transmission service, it needs system scheduling to select the appropriate edge node:

  • No Single Point: The transmission dispatching service is deployed in multiple locations in the Agora global network, isolating any single point of failure and attack.

  • Service Isolated by Region: Agora only provides three scheduling nodes for each user, which ensures high availability and hides other service nodes.

  • Simple Denial of Service (DoS) Attack Prevention: If there are multiple malicious requests from the same IP, Agora will automatically block the IP for a period of time.

  • Rapid Recovery: If a server room is under attack, Agora provides special tools to help rebuild and recover the services within 30 minutes.

  • Function Isolation: If the dispatching service is not available, it does not affect the user to continue the ongoing communication.

Access Authorization

Whenever users try to access the Agora SD-RTN (Software-defined Real-time Network), they must go through a Dynamic Key check. For more information, see Security Keys .

  1. The client sends an authentication request to the App Server Infrastructure.

  2. The Dynamic Key generation module integrated by the App Server Infrastructure generates a Dynamic Key using the algorithms provided by Agora and passes the Dynamic Key to the client application.

  3. The client calls joinChannel or startRecordingService, and sets the Dynamic Key as the first parameter.

  4. The Agora Server receives the Dynamic Key and confirms that the request comes from a legal user, then allows access to the Agora Global Network.

There is no interaction between the App Server Infrastructure and the Agora Cloud during the entire authentication and authorization process; thus there is no possibility for any interception or attack.

Access Dashboard

Customers can access the customer dashboard through the Web or Restful API to check the Media Server Logs and Analytics Data.

The dashboard identity is linked to an email address provided by the customer.

Data Retention

Agora applies the following data retention policies:

Session Recordings

Customer recordings are only stored on the customer servers. Customers have the option of encrypting each file for each recording.

Operational Metrics and Customer Account Data

  • Data logs collect electronic transaction/session data such as IP addresses, the user agent type, and the OS type; but does not collect text messaging.

  • Data logs will be kept for a maximum of two years from the date of the data origination:

    • Data logs will be kept in a secure place to reduce the risk of tampering.

    • Customer account passwords are not logged under any circumstance.

    • Data logging of administrative changes to your Agora account will be stored.

  • Customer account data will be shared with Agora; such as company name, address, and phone number (does not include your end-customer or end-user application data).

Access Control

Electronic Access Controls

In order to operate and maintain the Agora services, authorized employees have access to the production machines.

To access the production machines, each authorized employee is given a unique SSH key and password against that key. The employee also requires access to the Agora corporate network. All authorized employees are subject to a background check run by or on behalf of Agora.

Physical Access Controls

All production machines are hosted in third-party data centers. Each Agora hosting provider is required to maintain industry security best practices.

No Agora employee has any physical access to the production machines as they are not located in an Agora-owned facility or in an Agora-rented facility (which has a signed Business Associate Agreement with Agora). All on-site maintenance is performed by the hosting provider.

Application Security

There are several application-level security features available, including SSL, HTTPs and Secure Web sockets, AES Encryption, and End-user Authorization Management.

Roles and Responsibilities

Agora sets responsibilities for its own staff and customers.

Roles and Responsibilities within Agora

Security roles and responsibilities within Agora are categorized as follows:

Role Responsibilities
Information Security Sub-Committee The Information Security Sub-committee (ISSC) is responsible for the development and implementation of policies and procedures. The ISSC monitors company adherence, and conducts regular technical and non-technical evaluations of Agora’s security policies. The ISSC also designates which employees are authorized employees.
Authorized Employee An authorized employee has access to the production machines required for the support and maintenance of the Agora service as determined by the ISSC.
All Other Staff All other staff are required to maintain confidentiality as required by their terms of employment and are required to immediately report of any security breach.

Shared Responsibilities

When evaluating the Agora Cloud, it is important for customers to understand and distinguish between security measures that:

  • Agora implements and operates; and

  • Customers implement and operate related to the security of customer content and applications that use the Agora Cloud.

Customers retain control on the security they choose to implement to protect their own content, platform, applications, systems, and networks. For example, the security of the customer’s end-customer or end-user data collected by the customer, such as application logins, identities, passwords, payment information, names, and addresses are the responsibility of customer. This data is not shared with Agora.

Security Training

Agora provides training related to information security, and all authorized employees receive additional training according to the responsibilities extended to them.

Non-Compliance

Any employee who fails to comply with or breach the Agora information security policy will be dealt with accordingly, resulting in loss of employment or legal action.