Security
What we holdand what we never touch
Not a compliance page. The actual boundaries — where each kind of data lives, who can reach it, and what leaves your side at all.
The video
Your stream never passes through us
OKO wraps around the player you already use. The video goes from your source straight to the viewer — we are not in that path and never hold a copy.
YouTube, Vimeo, your encoder, your CDN. Your account, your terms, your recording.
Event page, chat, banners, materials, presence, analytics.
Data boundaries
Four stores, four sets of rules
Settings, live state, chat and files never share a lane. Each store enforces its own rules, so a mistake in one cannot open another.
Event configuration, team roles, finished session reports. Written from setup only.
Presence and what is visible on the page right now. The runtime of a finished session is cleared out; the accumulated counters are not reset — they're what the session report is built from.
Its own database instance. Chat traffic never mixes with analytics or presence.
Banners and card images. Browsers cannot write here at all — uploads go through server checks.
Your viewers
We look up the city, then forget the address
Geography in your reports comes from the IP address. The address itself is used for the lookup and never stored — not in the report, not in the logs.
Viewers are never asked to register or install anything. No account, no password, no profile — just an anonymous browser identifier used to count unique viewers, kept in that browser and not tied to any identity.
Access
Who can reach what
Editing setup, controlling the live room, moderating chat, viewing analytics, downloading reports — granted one by one, not as a single «admin» switch.
Hiding a button is not access control. Every protected operation is verified server-side, independently of what the interface shows.
An MCP key carries only the scopes you pick. Revoking it cuts access immediately — the already-issued token stops working, it does not wait to expire.
Anything touching identity, sessions or permissions is released on its own, with a rollback path prepared before the first production command.
Found something?
Send the affected URL, how to reproduce it, and what it lets you do. Please do not access data that is not yours, and leave out personal information you do not need to make the point.