Security
What we hold and what we never touch
Not a compliance page. The actual boundaries — where each kind of data lives, who can reach it, and what leaves your side.
The video
Your stream never passes through us
OKO wraps around the player you already use. The video goes from your source straight to the viewer — we are not in that path and never hold a copy.
YouTube, Vimeo or any player with an embed link. Your account, your terms, your recording.
Event page, chat, banners, materials, presence, analytics.
Data boundaries
Four stores, four sets of rules
Settings, live state, chat and files never share a lane. Each store enforces its own rules, so a mistake in one cannot open another.
Event configuration, team roles and finished session reports. Settings are written from Setup only; a saved report never changes.
Presence and what is visible on the page right now. When a session ends, its live data is cleared; the running totals stay, because the session report is calculated from them.
Its own database instance. Chat traffic never mixes with analytics or presence.
Banners and card images. Browsers cannot write here at all — uploads go through server checks.
Your viewers
We look up the city, then forget the address
Geography in your reports comes from the IP address. The address is used only for the lookup. OKO does not store it — not in the report, not in the database, not in its own application logs.
Viewers are never asked to register or install anything. No account, no password, no profile — just an anonymous browser identifier used to count unique viewers, kept in that browser and not tied to any identity.
Access
Who can reach what
Editing setup, controlling live blocks, moderating chat, viewing analytics, downloading reports — granted one by one, not as a single all-or-nothing “admin” switch.
Hiding a button is not access control. Every protected operation is verified server-side, independently of what the interface shows.
An MCP key carries only the scopes you pick. Revoking it cuts access immediately — the already-issued token stops working, it does not wait to expire.
Anything touching identity, sessions or permissions is released on its own, with a rollback path prepared before the first production command.
Found something?
Send the affected URL, how to reproduce it, and what it lets you do. Please do not access data that is not yours, and leave out personal information you do not need to make the point.