Security Overview

Last updated: October 25, 2026

PackVision handles camera footage, order evidence, and account data for your business. This Security Overview explains the safeguards we apply and what we ask you to do to keep your organization protected.

1. Account Protection

  • Password storage: passwords are protected with one-way cryptographic hashing. We cannot view or recover your plaintext password.
  • Two-factor authentication (2FA): you can enable an authenticator app from Account Settings to require a second verification step at sign-in.
  • Session lifetime: sessions last up to 90 days and are extended each time you sign in or refresh. Signing out ends the session immediately.
  • Google sign-in: if you connect a Google account, we store only the basic identity tokens needed to sign you in.

2. Encryption in Transit

All traffic between your browser, the PackVision dashboard, the API, and your connected desktop agent is protected with TLS/SSL. This includes sign-in, metadata synchronization, live camera preview, and remote recording playback.

3. Organization Isolation and Roles

  • Every record belongs to a single organization. Requests are authorized against the organization stored in your active session, never against an identifier supplied by the browser.
  • Roles are limited to Owner, Admin, and Member. Owners and admins manage organization settings, members, and billing; members work with stations and recordings.
  • Switching organizations requires membership in that organization and is verified on every request.

4. Local-First Video Handling

  • Continuous recordings stay on the computer where the desktop agent runs. They are not uploaded automatically.
  • The cloud stores order metadata, timestamps, station names, and proof snapshots.
  • When you request remote playback, the video is relayed in transit only. Relay infrastructure does not record or retain your video.
  • Local video remains under your physical control. Retention, disk usage, and cleanup are configured on your own machine.

5. Cloud-Saved Evidence

  • Footage is uploaded to cloud storage only when an authorized user explicitly chooses Save to cloud or exports a dispute clip.
  • Saved evidence is protected by the same organization isolation and role checks as the rest of the dashboard.
  • Retention follows the period you select: Permanent, 30 days, 60 days, or 90 days.
  • Every recording carries a tamper-proof evidence verification code so a clip can be checked for authenticity during a dispute.

6. Infrastructure and Monitoring

  • Infrastructure is hosted with enterprise cloud providers that maintain independent security certifications.
  • Database access uses least-privilege service credentials, and administrative access is restricted to authorized personnel.
  • We monitor availability, error rates, and security events. Logs never contain passwords, full session tokens, or private keys.

7. Your Responsibilities

  • Use a unique password and enable 2FA for every Owner and Admin account.
  • Remove members who no longer work with your organization, and rotate access when a device is lost or replaced.
  • Keep the computer that runs the desktop agent updated, physically secured, and protected by an operating-system password.
  • Report suspicious sign-in emails or unexpected station pairings to support immediately.

8. Reporting a Vulnerability

If you believe you have found a security issue, contact us at support@packvision.vn with enough detail to reproduce it. Please do not test against data that does not belong to you, and give us a reasonable opportunity to fix the issue before public disclosure.

9. Changes to This Overview

We review this overview as the platform evolves. Material changes are published on this page with a new "last updated" date.

Contact Us