Who sees what, who changes what
Security and access
ProVife restricts access with user, role and camera permissions, logs every administrative action, masks sensitive information and provides remote access over a single encrypted port.
A security system must itself be protected. ProVife Security and access uses predefined roles and per-camera permissions to determine what each user can see and change. Administrative actions, searches and reports are written to the audit log. Camera passwords, SMTP and MQTT passwords and access tokens are masked on screen and in responses; sensitive data is stored encrypted on the server. The client verifies the server certificate by its fingerprint. For remote access, only the server’s single HTTPS port is forwarded on the router; cameras do not need to be exposed to the internet, and by default only the ProVife Surveillance client can connect from outside. Updates are uploaded to the server as signed packages.
Least privilege
Each user sees only the cameras and screens they need for their job.
Auditability
The audit log answers who changed what, and when.
Secure remote monitoring
Cameras are monitored remotely without exposing them to the internet, using a single encrypted port and certificate verification.
Trusted updates
A package with an unverified signature or an older version is never installed on the server.
User, role and camera permissions
ProVife comes with predefined roles: system administrator, technical administrator, operator, viewer and integration. Live view, playback, events, PTZ, alarm acknowledgment, camera settings and AI permissions are granted separately at the camera level. Menu permissions determine which screens are visible. A user without permission cannot reach the live video, events or searches of that camera.
- Five predefined roles
- Separate permissions per camera
- Menu and page permissions
- Permission checks in search and reports
- Separate permission for Smart Home use
Audit log
Every administrative action on the server is written to the audit log with who performed it and when. Keyword searches, generated reports, plate list changes and remote access settings are also logged. The log can be viewed alongside events on the AI Playback screen, so administrative actions around an event can be followed on the same timeline. The log is kept on the server, so every client connected to the same server sees the same audit trail.
- All administrative actions
- Searches and reports
- Plate list changes
- Rejected remote sign-ins
- Viewed on the same screen as events
Password and secret protection
Camera passwords are never shown in plain text on screen or in logs; credentials inside addresses are masked. Passwords and keys for integrations such as SMTP, MQTT and Home Assistant are stored on the server and never returned in any response; when a masked value is sent back, the saved value is kept. New account passwords must be at least 12 characters, and failed sign-in attempts are limited per address.
- Masked camera passwords
- Integration passwords never returned in responses
- Camera and AI data stored encrypted
- New account passwords of at least 12 characters
- Failed sign-in limit per address
Certificate verification
All traffic between client and server goes over HTTPS. The client stores the certificate fingerprint of the server it connects to and verifies it on every connection; it never silently connects to a different server. The same fingerprint is expected when the remote address is used. The remote server’s certificate is also verified for email and MQTT connections. If the server is on the same computer, the client uses a local connection, but verification still uses the same fingerprint. This way, an intercepting device cannot read the traffic.
- Encrypted client–server traffic
- Certificate fingerprint pinning
- Same verification on local and remote addresses
- Certificate verification for email and MQTT
Remote access and the Surveillance client
Sign-in, live video, playback, events and images are served over the server’s single HTTPS port. Once this port is forwarded to the server on the router, remote access is ready. An optional remote address is entered in the ProVife Surveillance client; the client tries the local address first and switches to the remote address if it cannot connect. External connections from the administration client are off by default; rejected sign-ins are written to the audit trail.
- Single HTTPS port, default 7443
- Access without exposing camera ports
- Local address first, then remote
- Optional external access for administration
- Step-by-step guide to router port forwarding
Signed updates and integrity
Software updates are done by uploading a signed installation package to the server; the server and clients are updated from there. A package is accepted only if its signature is valid, its file size and digest match the signed values, and its version is newer than the running version. Updates preserve camera, user and recording data. Protected components are checked with a signed integrity seal, and the license is bound to the server hardware.
- Digitally signed update package
- Size and digest verification
- Only newer versions accepted
- Updates that preserve settings and recordings
- Signed integrity seal and hardware-bound license
Technical specifications
| Predefined roles | System administrator, technical administrator, operator, viewer, integration |
|---|---|
| Camera permissions | Live, playback, events, PTZ, acknowledgment, camera settings, recording, AI |
| Password policy | At least 12 characters for new accounts |
| Failed sign-in limit | 10 attempts per 5 minutes per address |
| Connection | HTTPS, certificate fingerprint pinning |
| Remote access port | Single TCP port, default 7443 |
| Remote sign-in | Surveillance on, Administrator off by default |
| Updates | Signed package, size and SHA-256 verification |
| Interface languages | Turkish, English, German, French, Arabic |
Frequently asked questions
Can I monitor remotely without exposing cameras to the internet?
Yes. Only the ProVife server’s single HTTPS port is forwarded on the router. Live video, recordings and events come through this port; camera ports are not exposed.
Can the system be administered remotely?
By default, only the ProVife Surveillance client can connect from outside, and administration stays on the site network. If you wish, you can allow the administration client to connect from outside on the Remote access page.
How are camera passwords protected?
Camera passwords are stored encrypted on the server and masked on screen and in logs. Integration passwords are never returned in any response either.
How are updates distributed?
The signed installation package is uploaded to the server from the Software update page. Once the package is verified, the server and clients are updated from there; settings and recordings are preserved.