Security at StreamPlay

Responsible disclosure

If you find a vulnerability in streamplay.ai, the public REST API, our streaming endpoints, or a related StreamPlay service, please email us before publishing it.

• Security mailbox: security@streamplay.ai
• Fallback: support@streamplay.ai
• Machine-readable contact: /.well-known/security.txt (RFC 9116)

Include the affected host or product, a short impact description, and enough detail for us to reproduce. Do not include customer data, credentials, or exploit payloads in the first message. We acknowledge reports and do not pursue legal action against good-faith researchers who follow this process.

What we run in production

Public traffic for streamplay.ai and our video delivery infrastructure is served over HTTPS and leverages global CDNs for secure, edge-based delivery and DDoS protection. Application APIs require robust authentication, and media assets are protected via Multi-DRM (Widevine, PlayReady, FairPlay) to prevent unauthorized distribution.

Compliance posture

StreamPlay maintains strict operational controls and aligns with industry-standard compliance requirements to secure high-value video assets for our broadcasters and operators. Our infrastructure and cloud providers (AWS, CDNs) maintain their own SOC 2 / ISO attestations for the physical and network infrastructure we utilize.

Enterprise and broadcaster teams can request a security questionnaire (SIG, CAIQ, or custom) at security@streamplay.ai.