Security & Compliance — @kaltura/intelligent-agents

Defaults are secure. Where a strict setting would hurt usability, the SDK keeps a usable default and gives you an option to tighten it, noted in this file.

• No runtime dependencies, no install scripts. The SDK is sourced directly from git (src/), not a package registry, so there's zero transitive supply-chain surface.
• All cryptography is delegated to the platform. The SDK never rolls its own crypto: TLS and DTLS-SRTP (the encryption protocol securing WebRTC audio and video) come from the host (Node tls/crypto, browser WebCrypto/TLS). Run Node/OpenSSL in FIPS mode and a FIPS-validated OS/browser to operate in a FIPS-validated configuration (NIST SC-13).
• Secrets never reach the client. The Admin Secret lives only server-side, in Management. The browser KalturaAvatarSession takes only a short-lived, entitlement-ON user-session token.

Framework crosswalks map the SDK control-by-control to HIPAA, HITRUST, the OWASP LLM/Agentic Top 10, and avatar/deepfake/voice-clone law (EU AI Act Art. 50, NO FAKES, CA SB 1001, BIPA, C2PA). See the framework crosswalks section below, which also includes a copy-paste secure production baseline config.

Reporting a vulnerability

Email security@kaltura.com with details and a PoC if available. Please do not open a public issue for an undisclosed vulnerability. We acknowledge within a few business days and coordinate disclosure.

Table of contents

• AI-application controls
• KS guidance for agents
• Session type
• Token lifecycle
• Audit logging
• Transport security
• Browser hardening
• Isolation & multi-tenancy
• Supply-chain integrity
• Shared-responsibility control matrix
• FIPS mode
• Data residency
• Data handling and deletion
• Framework crosswalks
• HIPAA
• HITRUST CSF
• OWASP Top 10 for LLM Applications
• OWASP Agentic
• Avatar / digital-human / deepfake / voice-clone
• Secure production baseline

AI-application controls (OWASP LLM/Agentic; HIPAA technical safeguards)

Guardrails for the AI/agent layer. Most are opt-in: pass the callback or option. Framework mapping: framework crosswalks.

KS (Kaltura Session) guidance for agents (AC-3 / AC-6 / IA-2)

A KS carries the privileges that decide what it can do. Full privilege reference: Kaltura API Authentication and Security.

For anything that reaches a browser, mint conversation/agent tokens (with a per-user userId) or widget tokens. Keep admin tokens server-side. createConversationToken/createAgentToken reject extraPrivileges that disable entitlement (entitlement_violation). Which of the two to use: Conversation token or agent token?.

Admin-type tokens (createAdminToken(), or sessionType: 'admin' on a conversation/agent token) are for your server. Your server decides at mint time what reaches a browser. The browser SDK can't check it: a real KS's privileges are encrypted, so inspectKs() reports disableEntitlement: null.

Session type

createConversationToken() and createAgentToken() mint a user session (KS type 0) by default: setrole:PLAYBACK_BASE_ROLE, entitlement ON. sessionType: 'admin' mints an admin-level session (KS type 2, no forced role), limited only by the role and privileges you set. createAdminToken() is always type 2 with disableentitlement, server-side only. Every type 2 mint needs a userId, which becomes the owner of anything the token creates. Minting options: Authentication.

What each token can reach:

• Always pass a per-user userId when you mint a conversation or agent token. Any stable opaque id works. The user needs no registration.
• Widget tokens can't separate users. Keep each threadId on your server, stored per user. To separate users in a browser, use the per-visitor path.
• A threadId owned by another user is refused. The server answers HTTP 200 with an error segment. The SDK throws thread_access_denied: Refusals that arrive with HTTP 200.
• Which methods take which token: Threads.

subjectId is for audit only. It is not an access boundary. Use userId on the token for that.

Token lifecycle (RFC 9700 OAuth 2.0 Security BCP; NIST AC family)

• Short-lived by default: browser-bound tokens (conversation/agent) default to 30 minutes, admin to 1 hour. Short TTL is the primary revocation lever for a stateless KS (RFC 9700 §6.1). Override per call with ttlSeconds, up to 86400 s (24 h) for browser-bound kinds and 7 days for admin; longer throws ttl_too_long. To refresh, your server mints a fresh token and the browser calls session.setToken(freshKs), with no reconnect.
• Least privilege / binding (RFC 9700 §2.3, §4.10): tighten a token with the structured restrictions option instead of hand-crafting privilege strings. { role, actionsLimit, ipRestrict, uriRestrict, sessionGroupId } compiles to the matching Kaltura privileges (setrole/actionslimit/iprestrict/urirestrict/sessionid). role needs sessionType: 'admin'. All restrictions are optional; none is set by default. Values and limits: Authentication.
• Active revocation (RFC 9700 §5.2.1.1; SOC 2 CC6.2/CC6.3): sessions.revoke(tokenOrKs) ends a leaked token within seconds (Kaltura session/end). Tokens that share a restrictions.sessionGroupId are revoked together: revoking any member ends the whole family. Returns a receipt: { revokedAt, partnerId, _meta }.
• Vault/KMS (NIST IA-5): pass getAdminSecret: () => fetchFromVault() to fetch the secret per-mint instead of holding it; it is never stored as an enumerable field.

Audit logging (NIST AU-2 / AU-3 / AU-12; OWASP Logging; SOC 2 CC7)

The SDK is an event emitter, not a logging framework. Pass onAuditEvent to Management and/or KalturaAvatarSession to receive discrete, already-redacted, structured AuditEvent objects, and route them into your SIEM. This is opt-in: no event fires until you pass this hook.

new Management({ partnerId, adminSecret, onAuditEvent: (e) => siem.write(e) });

Event catalog

Event fields

Every event carries this AU-3 content shape:

Guarantees

• The raw KS is never included in an event. Only its kind and scope are.
• Free-text fields are stripped of CR/LF (CWE-117 log-injection guard).
• A throwing SIEM sink can never break a mint or a live turn. Event emission is crash-safe.
• This audit stream is distinct from the chatty debug logger and is never gated behind a debug level.

Transport security (NIST SC-8; OWASP WSS/TLS)

• KalturaAvatarSession rejects non-TLS conversationManagerUrl/srsBaseUrl (insecure_transport). The same rule covers every Management base URL and the sessions' genieUrl.
• A base URL that is empty, does not parse, uses a scheme other than https/http, or carries a username or password throws bad_request at construction.
• Loopback and private hosts (localhost/127.0.0.1, RFC 1918 ranges, link-local, and their IPv6 equivalents) are allowed for dev, with a loud one-time warning.
• Cleartext to a public host requires an explicit allowInsecureTransport:true (dev/test only, never production).
• Pass server-minted ephemeral TURN credentials (turnCredentials from appInit, RFC 7635). Without them the SDK uses its default TURN credentials and warns.

Browser hardening (OWASP ASVS / WebSocket CS)

• Memory-only token: the SDK keeps the token in a non-enumerable instance field and drops it on disconnect(). Do not put a conversation token in localStorage/sessionStorage (XSS-exfiltratable). Pass it directly and re-mint from your server on reload.

• No token in URLs: tokens travel only in the socket auth field or the Authorization header, never a query string (OWASP API2:2023).

• Prototype-pollution guard: setDynamicPrompt data is scrubbed of __proto__/constructor/prototype before it touches the wire.

• CSP: the SDK uses no eval/new Function. A working policy sets:

  • connect-src to your live-session control-plane host (conversationManagerUrl), the WHEP video-egress host (srsBaseUrl), and your TURN host
  • media-src blob:
  • script-src to your injected socket.io origin, pinned with SRI (see the README's "Injecting socket.io securely")

  Also set frame-ancestors on the embedding page. A mic-capable widget needs anti-clickjacking headers.

• AI disclosure (EU AI Act Art. 50): a disclosure event fires before the avatar's first words. requireDisclosureAck holds the avatar greeting until acknowledgeDisclosure(). Note: ASR (Automatic Speech Recognition, the mic-to-text channel) connects before disclosure, so obtain consent before connect() in IL/TX/WA.

Isolation & multi-tenancy (NIST SC-4 / AC-6(4))

No SDK module holds credential or tenant state at module scope. The admin secret, KS, and partnerId live only as (non-enumerable) instance fields. A single process can safely run N Management and M KalturaAvatarSession instances for different tenants, each with fully independent tokens, transports, and teardown. Nothing is shared or global.

Supply-chain integrity (SLSA / OpenSSF / EO 14028)

• Zero runtime dependencies, no install lifecycle scripts.
• No registry publish step. The SDK is consumed straight from its git tags (src/, imported by path or served via jsDelivr's GitHub CDN). There is no npm package.

Shared-responsibility control matrix (NIST 800-53)

The SDK generates and protects the records and enforces the client-side controls below; the operator owns storage-side controls a client library cannot provide (retention, tamper-evidence, non-repudiation).

FIPS mode (how-to)

# Node with an OpenSSL FIPS provider:
node --enable-fips your-server.js
# or via OpenSSL 3 FIPS provider config (OPENSSL_CONF / fipsmodule.cnf)

In the browser, FIPS validation is a property of the OS/browser crypto module. Deploy on a FIPS-validated platform; the SDK adds no non-validated crypto.

Data residency (SC-7)

The SDK is a thin client. It contacts only the Kaltura endpoints you configure (agenticUrl/genieUrl/ovpUrl/messagingUrl/conversationManagerUrl/srsBaseUrl/turnServerUrl). There is no telemetry or hidden beacon. The optional ./experience/analytics module sends KAVA application events to analytics.kaltura.com, and only when your code calls it. Point every URL at your in-boundary (e.g. US-Gov) hosts to keep all data within your authorization boundary.

Session hosts come from appInit, not from your config. appInit returns the conversationManagerUrl, srsBaseUrl and turnServerUrl for your partner's region. Pass them to KalturaAvatarSession unchanged (new KalturaAvatarSession({ ...appInit, token: appInit.ks })). Do not hard-code them. If you omit conversationManagerUrl, the session falls back to the US host.

The region option covers the rest. It fills the four Management base URLs (agenticUrl, genieUrl, ovpUrl, messagingUrl) and the session genieUrl from one REGIONS entry. Management never falls back to another region: a service the region lacks throws region_unavailable instead of reaching a US host. region does not change the analytics host.

This residency guarantee covers the SDK's own configured endpoints only. A lifecycle rule's sendInsightEmail action sends thread-derived content to the recipients you list, and the URL-pinning above does not apply to it. Your code decides which recipients and regions are allowed. A deployment that must protect PHI/PII boundaries vets the recipients list and reviews residency before it uses this action.

Data handling and deletion

The SDK stores no conversation data itself. The one exception is Presenter session memory, which stays off unless you pass a storage object. How long Kaltura keeps data is a property of your account: ask your Kaltura Account Manager.

Every delete needs an admin token (a user-session token can also delete its own threads) and { confirmPermanent: true }.

To erase everything for one end user, list their threads with filter.userIdEquals, then pass the ids to threads.delete. The SDK has no single call for this and no way to see when a soft delete is purged.

Framework crosswalks

A client SDK can implement technical controls and generate the records, but it cannot sign a contract, retain logs, or authenticate the human user. Each table marks SDK (the library provides it) vs Operator (your duty, fed by the SDK's hooks/events).

HIPAA (45 CFR Part 164)

Gating item: Kaltura offers a Business Associate Agreement, covering Kaltura and its avatar/ASR/TTS/brain subprocessors, as required before any PHI flows. Contact your Kaltura Account Manager or Customer Success Manager to execute one.

PHI note: a patient may speak PHI to the avatar, so captions, transcripts, screenshots, and request-variable context (setDynamicPrompt's page_context) can carry PHI. The SDK surfaces these to your app but persists none of them. Treat them as PHI in your app.

HITRUST CSF (incl. the AI Security Assessment)

The SDK is an AI Application Provider component you can largely inherit in a HITRUST assessment. Kaltura's platform posture is the upstream inheritance source.

Prompt-injection note: the prototype-pollution scrub on setDynamicPrompt/inbound is object-injection defense, not prompt-injection defense. redact() is log-scoped, not an output content filter. Don't pass unsanitized end-user text into setDynamicPrompt or any request variable. Request variables stay on the thread, so see Dynamic Data Injection for what that means for a poisoned value. Instruction/data separation, source allow-listing, and model guardrails are operator/platform duties.

OWASP Top 10 for LLM Applications (2025)

Bounded-parser contract: nav/action commands parsed out of avatar text must be bounded allow-lists, never eval/dispatch of arbitrary strings. parseSlideNumber (integer-bounded, range-checked) is the template.

OWASP Agentic (Agentic Security Initiative / Top 10 for Agentic Apps)

The avatar is an agent (navigates, renders GenUI, captures leads, searches knowledge). The SDK is the client boundary where agent-initiated actions surface.

Avatar / digital-human / deepfake / voice-clone

Secure production baseline (CM-6)

Copy-paste hardened configuration for a regulated deployment:

// Server: Management
const mgmt = new Management({
  partnerId, getAdminSecret: () => vault.fetch('kaltura-admin'),  // or adminSecret
  onAuditEvent: (e) => siem.write(e),
});
const token = await mgmt.sessions.createConversationToken({
  configId, ttlSeconds: 1800,                 // short-lived (RFC 9700)
  userId: opaqueUserId,                       // per-user identity: reaches only this user's threads
  restrictions: { sessionGroupId: caseId },   // revocable family
});

// Browser: Experience
new KalturaAvatarSession({
  token, conversationManagerUrl, srsBaseUrl, turnServerUrl,      // all https/wss
  turnCredentials,                            // ephemeral (RFC 7635), not the SDK default
  allowInsecureTransport: false,              // never true in production
  requireDisclosureAck: true,                 // EU AI Act / biometric jurisdictions
  idleTimeoutMs: 900000,                      // HIPAA auto-logoff
  subjectId: opaqueUserId,                    // audit only: HIPAA unique-user-id (never PHI)
  maxTurnsPerMinute: 30,                      // LLM10 valve
  onBeforeSend: (t) => myGuardrail(t),        // LLM01 input filter
  onAgentAction: (a) => myPolicy(a),          // LLM06 / Agentic action gate
  onAuditEvent: (e) => siem.write(e),
});

Plus: pin the injected socket.io with SRI; set a strict CSP (connect-src your control-plane, WHEP and TURN hosts; media-src blob:; no inline script/unsafe-eval) and frame-ancestors on the embedding page; render the disclosure accessibly.