Security

Information security policy

This section provides information security policy for Agora services.

Agora services provide built-in encryption and customized encryption. You can use either of them to implement encryption. The following diagram describes the encrypted data transmission process:

Purpose

Agora is committed to safeguarding the confidentiality, integrity, and availability of all users' physical and electronic information assets.

• Confidentiality against unauthorized access and eavesdropping
• Integrity against tampering and forgery
• Availability of data transmission through the Agora SDRTN®

Scope

This article describes how Agora protects customer data with security controls.

Data classification

All customer data, in all formats or media types, is classified according to the following categories and protected accordingly.

Data security

The communication between the user and the Agora server is protected by transmission protocols, such as the Agora private transmission protocol, Transport Layer Security (TLS) and Web Socket Secure (WSS). You can also use Advanced Encryption Standard (AES) or a customized encryption algorithm for the encryption of audio and video data.

During data transmission, the Agora SDRTN® does not transmit any encryption key information. Call content information can only be decrypted on the terminal device (such as the client app and the customer's on-premise recording server) through the client authorization key.

Data availability

• Large and distributed data centers: Agora has multiple data centers providing services globally, and any attack on one data center cannot affect others.
• Rapid recovery: When a data center is subjected to malicious attacks that are difficult to prevent, such as a distributed denial-of-service (DDoS) attack, Agora will automatically isolate the data center and avoid affecting users' services.
• DDoS attack prevention: Agora has deployed anti-DDoS firewalls in each core cloud data center. Agora has more than two hundred distributed data centers around the world, which guarantees sufficient capabilities and resources to control the risk of DDoS attacks.

Data storage

Agora provides customers with the Agora On-Premise Recording SDK and Agora Cloud Recording, enabling customers to record part or all of the call contents. When using the recording services, all recorded video or audio files are stored on the storage server provided by the customer.

Access authorization

End users can access the Agora SDRTN® using a dynamic key, see Secure authentication with tokens.

Electronic access controls

Agora strictly controls the data access on all internal systems. All users have independent internal accounts and authorization systems, and must pass two-step verification. All access records are recorded.

All servers involving user data are strictly audited and protected. Agora employees will only access the production server when necessary, and only by obtaining temporary authorization. Operation records are kept for the whole process.

Physical access controls

All operating servers are hosted in computer rooms that meet ISO 27001 or above information security management certification standards, and all computer rooms protect information security in accordance with the escrow agreement or the Data Protection Association (DPA). Both third-party hosting providers and Agora employees must be approved before they can access servers and equipment.

Roles and responsibilities

Agora sets the responsibilities for its own staff and customers. See the following sections for more information.

Roles and responsibilities within Agora

Security roles and responsibilities within Agora are categorized as follows:

Shared responsibilities

When evaluating the Agora SDRTN®, it is important for customers to understand and distinguish the following security measures:

• The security measures that Agora implements and operates.
• The security measures that customers implement and operate to ensure the security of call content information and application when using the Agora SDRTN® services.

Customers retain control of the security measures they choose to protect their personal information, platform, applications, systems, and networks. Agora customers should be responsible for all information they collect from users and themselves, such as application logins, identities, passwords, payment information, names, and addresses.

Agora recommends adding obvious prompts before accessing the users' personal information. For example, add an Enable/Disable button with which the user can agree or disagree to share personal information.

Security training

Agora conducts information protection, security and compliance training for all new employees. Agora also ensures that all employees receive information confidentiality training at least once a year. All authorized employees (employees who have access to the production machines) will receive additional training.

Non-compliance

Employees must comply with confidentiality agreements and internal security systems. If a non-compliant situation occurs, Agora will take the corresponding measures depending on the severity of the situation, including but not limited to having conversations with the at-fault employees, strengthening training and education, dissolving labor agreements, and pursuing other legal liabilities.

Reporting potential security risks

Security FAQ

Whitepaper

People engage longer when they see, hear, and interact with each other. The future of meaningful human connections is made possible now with Agora’s Real-Time Engagement Platform. People rely on Agora’s Real-Time Engagement Platform to exchange millions of calls and messages, with vivid voice and video embedded in any application, on any device, anywhere.

Agora, Inc. is proud to offer the professional Real-Time Engagement Platform as a Service (RTE PaaS) with Compliance, Safety, Security, and Trust. Our commitment to compliance, data, and information security and privacy protection is a part of the core values of our company. From our Software-Defined Real-Time Network (SDRTN®) architecture to our day-to-day business operations, Agora continually invests in innovations and business processes that build trust with our customers, investors, and developer community. Agora works to high standards to follow the best security practices and comply with strict privacy regulations and standards as we respect the privacy of all our customers.

The information contained in this document is intended to provide transparency in relation to Agora’s security stance and processes. If you think you may have found a security vulnerability within any of Agora’s services, please contact our security team directly at security@agora.io.

Data security and user privacy are the top priorities of Agora. Agora is committed to building a professional RTE PaaS with Compliance, Safety, Security, and Trust. It is a critical responsibility for Agora to help ensure the confidentiality, integrity, and availability of systems and data, and Agora continues to work hard to maintain that trust. If you have any questions or concerns, please contact our security team or account managers.

ISO certificates

Security and compliance are the basic requirement for real-time interaction. Agora complies with the compliance requirements of different countries and industries to create safe and reliable cloud services.

The ISO certification of Agora has passed the supervision and accreditation of three different certification organizations: IFA CNAS (China National Accreditation Service for Conformity Assessment), UKAS (United Kingdom Accreditation Service), and DNV (Det Norske Veritas). Agora builds cloud service technology worldwide in accordance with internationally recognized standards to ensure the information security of global customers.

Security best practices

Security and compliance are essential for real-time engagements through technology. In order to provide safe and reliable cloud services, Agora adheres to the compliance requirements of different countries, regions, and industries, in addition to being certified to ISO/IEC 27001. For more information, see ISO certificates.

Level 1 - Channels separation

The channels architect is the first built-in layer of protection. Agora creates an independent and isolated channel for each audio, video, or messaging data transmission. All channels are logically separated and only authenticated users from the same App ID can join the same channel.

Level 2 - Token-based authentication

The second layer of protection is on the authentication layer. This is done via using the dynamic token-based authentication. The token is a short-lived access key, which is generated by the app backend and allows users to access the Agora platform after the user is properly validated by the app.

A token is generated with important information such as App ID, user ID (uid), channel name, and expiration date.

The app developer can enable token-based authentication (App Certificate) on Agora Console. When enabled, all user’s request to join a channel must be done with a valid token.

Please note for best security practices, you need to set the token expiration time (24 hours by default). A token has three expiration timestamps:

• Token expiration: How long a token is valid for, that is, how long a user can stay in a channel.
• Privilege expiration:
• Join a channel: How long a token can be used to join a channel.
• Streaming privilege: Whether a user can send audio, video or messaging to the channel, or join as an audience member. This privilege is not enabled by default.

Level 3 - Encryption

The next layer of security in the Agora platform is encrytion. Agora supports transmission encryption and data encryption.

To guarantee data confidentiality during transmission, Agora uses the AUT (Agora Universal Transport) encryption protocol, Agora's proprietary secured transport layer.

Data encryption encrypts all the audio and video streams with a symmetric key and encryption controlled by the app developer. In this level the app provides a symmetric encryption key to the local SDK libraries.

The SDK encrypts all the captured media using the key and the configured encryptions using AES 128/256 (based on configuration). The data is sent encrypted to Agora SDRTN® and from there to the other endpoints in the channel. The receiving endpoint will use the key provided by the app layer to decrypt the media streams and send to the renders. With this method, only the application knows the keys. In the Native SDK (iOS, Android, Mac, Windows) the keys are not sent to Agora servers.

When using Other Agora services like Web SDK, Cloud Recording, Content Moderation, Transcoding etc, encryption is done a bit differently and it is not end-to-end. In this case media is still encrypted but the Agora service needs to be aware of the key to be able to connect to the channel and provide service. For example, in Web SDK the User/Browser protection is done via the web-server protection (HTTPS) as well as the WebRTC standard, security practice (encryption, key management etc). More information on WebRTC security can be found here.

The media encryption on Web SDK is done via WebRTC standard but the interoperability to Agora is done using Agora’s encryption engine and the encryption key is passed securely to the Web SDK servers via the APIs. The key is required as the Agora edge server will convert from WebRTC protocols to Agora’s protocol and allow interoperability with Native SDK. Similar situation happens with Cloud Recording, Content Moderation etc., where the Restful APIs are used to securely pass the key for the channel.

Level 4 - Network geofencing

To conform to the laws and regulations of different countries and regions, the Agora Video SDK and the Signaling SDK support network geofencing, which limits the transmission of data to within a specified region.

These SDKs support network geofencing in the following regions: global (default), North America, Europe, Asia (excluding Mainland China), Japan, India, and Mainland China. Once a customer specifies a region using geofencing, no audio, video, or message can access Agora servers outside that region.

Security best practice checklist

Use this list to quickly check what measures you have or have not taken to best protect the security of you app and users:

1. Enable token-based authentication on Agora Console.
2. Disable No certificate in your project management page. Once it is done your app authenticates users with tokens only.
3. Deploy a token server in your backend services.
4. Protect the token server and only allow the app backend server to connect to the token server.
5. Set the token expiration date to a reasonable time. See Deploy a token server.
6. If needed, contact support@agora.io to enable token privilege and set token per role.
7. For additional security if needed work with the Agora SA team to customize the token server and modify the token join privilege to a low time, like 5 min. This is more advance and recommended after app development is completed.
8. Channel encryption key management – generate a random key (secret) per channel at the time of creating the channel, do not reuse encryption keys.
9. Pass the channel encryption key (secret) securely outside of Agora engine to authenticated endpoints that are allowed to join the channel.
10. For additional security, you can also do the following:
    1. Set the “Agora channel name” to a one-time random string managed by your app.
    2. Set the Agora uid to a one-time numeric id that is mapped to the user on the app level. Do not use the users' real ID on your app as the Agora uid.

Agora bug bounty program

Agora is always looking to better protect our system and customers. Therefore, we invite security researchers to report any bugs or vulnerabilities they discover to us.

Once we receive notice of a bug or vulnerability, Agora customer service and security teams will respond quickly to address the issue.

In addition to our gratitude, those who report a vulnerability may be eligible for a monetary “bounty” based on the risk associated with the vulnerability and the importance of the affected system.

System importance classifications

The following table shows system importance classifications (in descending order), along with some example Agora assets:

Vulnerability severity classifications

The following list outlines detailed examples of how various vulnerabilities would be classified:

Bug Bounties

Please report any potential risks of Agora services that you may notice to security@agora.io . Any bounties awarded will conform roughly to the following ranges (based on the severity and system location of the bug or vulnerability, payable in $US):

• Critical: $300 to $5000
• High: $200 to $2000
• Medium: $150
• Low: $50
• Info: $0

Note: Agora reserves the sole right to determine any reward amount given.