[{"data":1,"prerenderedAt":753},["ShallowReactive",2],{"navigation_docs_en":3,"-en-installation-security-requirements":435,"-en-installation-security-requirements-surround":748},[4,25,83,133,247,262,332,369,415],{"title":5,"path":6,"stem":7,"children":8,"page":24},"Getting Started","\u002Fen\u002Fgetting-started","en\u002F1.getting-started",[9,14,19],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fen\u002Fgetting-started\u002Fintroduction","en\u002F1.getting-started\u002F1.introduction","i-lucide-house",{"title":15,"path":16,"stem":17,"icon":18},"Quickstart","\u002Fen\u002Fgetting-started\u002Fquickstart","en\u002F1.getting-started\u002F2.quickstart","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Concepts","\u002Fen\u002Fgetting-started\u002Fconcepts","en\u002F1.getting-started\u002F3.concepts","i-lucide-book-open",false,{"title":26,"path":27,"stem":28,"children":29,"page":24},"Live Production","\u002Fen\u002Flive-production","en\u002F2.live-production",[30,35,55,69],{"title":31,"path":32,"stem":33,"icon":34},"On air","\u002Fen\u002Flive-production\u002Fon-air","en\u002F2.live-production\u002F1.on-air","i-lucide-radio",{"title":36,"path":37,"stem":38,"children":39,"page":24},"Live Streams","\u002Fen\u002Flive-production\u002Flive-streams","en\u002F2.live-production\u002F2.live-streams",[40,45,50],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Fen\u002Flive-production\u002Flive-streams\u002Foverview","en\u002F2.live-production\u002F2.live-streams\u002F1.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Options","\u002Fen\u002Flive-production\u002Flive-streams\u002Flive-stream-options","en\u002F2.live-production\u002F2.live-streams\u002F2.live-stream-options","i-lucide-file-text",{"title":51,"path":52,"stem":53,"icon":54},"Start and stop","\u002Fen\u002Flive-production\u002Flive-streams\u002Fstart-stop","en\u002F2.live-production\u002F2.live-streams\u002F3.start-stop","i-lucide-play-circle",{"title":56,"path":57,"stem":58,"children":59,"page":24},"Scheduler","\u002Fen\u002Flive-production\u002Fscheduler","en\u002F2.live-production\u002F3.scheduler",[60,64],{"title":41,"path":61,"stem":62,"icon":63},"\u002Fen\u002Flive-production\u002Fscheduler\u002Foverview","en\u002F2.live-production\u002F3.scheduler\u002F1.overview","i-lucide-calendar-clock",{"title":65,"path":66,"stem":67,"icon":68},"Planned actions","\u002Fen\u002Flive-production\u002Fscheduler\u002Fplanned-actions","en\u002F2.live-production\u002F3.scheduler\u002F2.planned-actions","i-lucide-alarm-clock",{"title":70,"path":71,"stem":72,"children":73,"page":24},"Recordings","\u002Fen\u002Flive-production\u002Frecordings","en\u002F2.live-production\u002F4.recordings",[74,78],{"title":41,"path":75,"stem":76,"icon":77},"\u002Fen\u002Flive-production\u002Frecordings\u002Foverview","en\u002F2.live-production\u002F4.recordings\u002F1.overview","i-lucide-circle-dot",{"title":79,"path":80,"stem":81,"icon":82},"Editor","\u002Fen\u002Flive-production\u002Frecordings\u002Feditor","en\u002F2.live-production\u002F4.recordings\u002F2.editor","i-lucide-scissors",{"title":84,"path":85,"stem":86,"children":87,"page":24},"Configuration","\u002Fen\u002Fconfiguration","en\u002F3.configuration",[88,102,107,120],{"title":89,"path":90,"stem":91,"children":92,"page":24},"Devices","\u002Fen\u002Fconfiguration\u002Fdevices","en\u002F3.configuration\u002F1.devices",[93,97],{"title":89,"path":94,"stem":95,"icon":96},"\u002Fen\u002Fconfiguration\u002Fdevices\u002Fdevices","en\u002F3.configuration\u002F1.devices\u002F1.devices","i-lucide-server",{"title":98,"path":99,"stem":100,"icon":101},"Groups","\u002Fen\u002Fconfiguration\u002Fdevices\u002Fgroups","en\u002F3.configuration\u002F1.devices\u002F2.groups","i-lucide-network",{"title":103,"path":104,"stem":105,"icon":106},"Sources","\u002Fen\u002Fconfiguration\u002Fsources","en\u002F3.configuration\u002F2.sources","i-lucide-cable",{"title":108,"path":109,"stem":110,"children":111,"page":24},"Encodings","\u002Fen\u002Fconfiguration\u002Fencodings","en\u002F3.configuration\u002F3.encodings",[112,116],{"title":108,"path":113,"stem":114,"icon":115},"\u002Fen\u002Fconfiguration\u002Fencodings\u002Fprofiles","en\u002F3.configuration\u002F3.encodings\u002F1.profiles","i-lucide-sliders-horizontal",{"title":98,"path":117,"stem":118,"icon":119},"\u002Fen\u002Fconfiguration\u002Fencodings\u002Fgroups","en\u002F3.configuration\u002F3.encodings\u002F2.groups","i-lucide-layers",{"title":121,"path":122,"stem":123,"children":124,"page":24},"Destinations","\u002Fen\u002Fconfiguration\u002Fdestinations","en\u002F3.configuration\u002F4.destinations",[125,129],{"title":121,"path":126,"stem":127,"icon":128},"\u002Fen\u002Fconfiguration\u002Fdestinations\u002Fdestinations","en\u002F3.configuration\u002F4.destinations\u002F1.destinations","i-lucide-send",{"title":98,"path":130,"stem":131,"icon":132},"\u002Fen\u002Fconfiguration\u002Fdestinations\u002Fpublishing-groups","en\u002F3.configuration\u002F4.destinations\u002F2.publishing-groups","i-lucide-share-2",{"title":134,"path":135,"stem":136,"children":137,"page":24},"Settings","\u002Fen\u002Fsettings","en\u002F4.settings",[138,151,156,172,188],{"title":139,"path":140,"stem":141,"children":142,"page":24},"Users","\u002Fen\u002Fsettings\u002Fusers","en\u002F4.settings\u002F1.users",[143,147],{"title":139,"path":144,"stem":145,"icon":146},"\u002Fen\u002Fsettings\u002Fusers\u002Fusers","en\u002F4.settings\u002F1.users\u002F1.users","i-lucide-user",{"title":98,"path":148,"stem":149,"icon":150},"\u002Fen\u002Fsettings\u002Fusers\u002Fuser-groups","en\u002F4.settings\u002F1.users\u002F2.user-groups","i-lucide-users",{"title":152,"path":153,"stem":154,"icon":155},"Security","\u002Fen\u002Fsettings\u002Fsecurity","en\u002F4.settings\u002F2.security","i-lucide-shield",{"title":157,"icon":158,"path":159,"stem":160,"children":161,"page":24},"Assets","i-lucide-image","\u002Fen\u002Fsettings\u002Fassets","en\u002F4.settings\u002F3.assets",[162,167],{"title":163,"path":164,"stem":165,"icon":166},"Logos","\u002Fen\u002Fsettings\u002Fassets\u002Flogos","en\u002F4.settings\u002F3.assets\u002F1.logos","i-lucide-images",{"title":168,"path":169,"stem":170,"icon":171},"Files","\u002Fen\u002Fsettings\u002Fassets\u002Ffiles","en\u002F4.settings\u002F3.assets\u002F2.files","i-lucide-clapperboard",{"title":173,"icon":174,"path":175,"stem":176,"children":177,"page":24},"External Storage","i-lucide-folder-cog","\u002Fen\u002Fsettings\u002Fexternal-storage","en\u002F4.settings\u002F4.external-storage",[178,183],{"title":179,"path":180,"stem":181,"icon":182},"Remote Folders","\u002Fen\u002Fsettings\u002Fexternal-storage\u002Fremote-folders","en\u002F4.settings\u002F4.external-storage\u002F1.remote-folders","i-lucide-folder-archive",{"title":184,"path":185,"stem":186,"icon":187},"Target Folders","\u002Fen\u002Fsettings\u002Fexternal-storage\u002Ftarget-folders","en\u002F4.settings\u002F4.external-storage\u002F2.target-folders","i-lucide-folder-up",{"title":189,"path":190,"stem":191,"children":192,"page":24},"Integrations","\u002Fen\u002Fsettings\u002Fintegrations","en\u002F4.settings\u002F5.integrations",[193,197,202,216],{"title":41,"path":194,"stem":195,"icon":196},"\u002Fen\u002Fsettings\u002Fintegrations\u002Foverview","en\u002F4.settings\u002F5.integrations\u002F1.overview","i-lucide-plug",{"title":198,"path":199,"stem":200,"icon":201},"MediaCopilot","\u002Fen\u002Fsettings\u002Fintegrations\u002Fmediacopilot","en\u002F4.settings\u002F5.integrations\u002F2.mediacopilot","i-lucide-sparkles",{"title":203,"icon":204,"path":205,"stem":206,"children":207,"page":24},"C21 Live Cloud","i-lucide-cloud","\u002Fen\u002Fsettings\u002Fintegrations\u002Fc21livecloud","en\u002F4.settings\u002F5.integrations\u002F3.c21livecloud",[208,211],{"title":41,"path":209,"stem":210,"icon":204},"\u002Fen\u002Fsettings\u002Fintegrations\u002Fc21livecloud\u002Foverview","en\u002F4.settings\u002F5.integrations\u002F3.c21livecloud\u002F1.overview",{"title":212,"path":213,"stem":214,"icon":215},"Accounts","\u002Fen\u002Fsettings\u002Fintegrations\u002Fc21livecloud\u002Faccounts","en\u002F4.settings\u002F5.integrations\u002F3.c21livecloud\u002F2.accounts","i-lucide-key-round",{"title":217,"icon":155,"path":218,"stem":219,"children":220,"page":24},"DRM Providers","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm","en\u002F4.settings\u002F5.integrations\u002F4.drm",[221,225,229,233,237,242],{"title":41,"path":222,"stem":223,"icon":224},"\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Foverview","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F1.overview","i-lucide-shield-check",{"title":226,"path":227,"stem":228,"icon":155},"Widevine","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Fwidevine","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F2.widevine",{"title":230,"path":231,"stem":232,"icon":155},"PlayReady","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Fplayready","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F3.playready",{"title":234,"path":235,"stem":236,"icon":155},"FairPlay","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Ffairplay","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F4.fairplay",{"title":238,"path":239,"stem":240,"icon":241},"Providers","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Fproviders","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F5.providers","i-lucide-shield-half",{"title":243,"path":244,"stem":245,"icon":246},"Workflow","\u002Fen\u002Fsettings\u002Fintegrations\u002Fdrm\u002Fworkflow","en\u002F4.settings\u002F5.integrations\u002F4.drm\u002F6.workflow","i-lucide-workflow",{"title":248,"path":249,"stem":250,"children":251,"page":24},"System Status","\u002Fen\u002Fsystem-status","en\u002F5.system-status",[252,257],{"title":253,"path":254,"stem":255,"icon":256},"Commands","\u002Fen\u002Fsystem-status\u002Fcommands","en\u002F5.system-status\u002F1.commands","i-lucide-square-terminal",{"title":258,"path":259,"stem":260,"icon":261},"Logs","\u002Fen\u002Fsystem-status\u002Flogs","en\u002F5.system-status\u002F2.logs","i-lucide-scroll-text",{"title":263,"path":264,"stem":265,"children":266,"page":24},"How Tos","\u002Fen\u002Fhow-tos","en\u002F6.how-tos",[267,272,277,282,286,291,296,300,304,309,313,318,323,328],{"title":268,"path":269,"stem":270,"icon":271},"Start and stop a Live stream","\u002Fen\u002Fhow-tos\u002Fstart-stream-via-api","en\u002F6.how-tos\u002F1.start-stream-via-api","i-lucide-terminal",{"title":273,"path":274,"stem":275,"icon":276},"Ingest a YouTube Live broadcast","\u002Fen\u002Fhow-tos\u002Fingest-youtube-live","en\u002F6.how-tos\u002F10.ingest-youtube-live","i-lucide-youtube",{"title":278,"path":279,"stem":280,"icon":281},"Source Synchronized Encoding (SSE) — bit-identical redundancy","\u002Fen\u002Fhow-tos\u002Fsource-synchronized-encoding","en\u002F6.how-tos\u002F11.source-synchronized-encoding","i-lucide-copy-check",{"title":283,"path":284,"stem":285,"icon":34},"Broadcast radio as video","\u002Fen\u002Fhow-tos\u002Fbroadcast-radio-as-video","en\u002F6.how-tos\u002F12.broadcast-radio-as-video",{"title":287,"path":288,"stem":289,"icon":290},"Real Time streaming to Dolby Millicast","\u002Fen\u002Fhow-tos\u002Freal-time-streaming","en\u002F6.how-tos\u002F13.real-time-streaming","i-lucide-zap",{"title":292,"path":293,"stem":294,"icon":295},"Publish to object storage (S3, Azure Blob)","\u002Fen\u002Fhow-tos\u002Fpublish-to-object-storage","en\u002F6.how-tos\u002F14.publish-to-object-storage","i-lucide-database",{"title":297,"path":298,"stem":299,"icon":224},"Protect a Live stream with multi-DRM","\u002Fen\u002Fhow-tos\u002Fmulti-drm-destination","en\u002F6.how-tos\u002F2.multi-drm-destination",{"title":301,"path":302,"stem":303,"icon":63},"Schedule a weekly recurring broadcast","\u002Fen\u002Fhow-tos\u002Fweekly-recurring-broadcast","en\u002F6.how-tos\u002F3.weekly-recurring-broadcast",{"title":305,"path":306,"stem":307,"icon":308},"Cut a clip in the Editor and send it to MediaCopilot","\u002Fen\u002Fhow-tos\u002Fexport-recording-to-mediacopilot","en\u002F6.how-tos\u002F4.export-recording-to-mediacopilot","i-lucide-upload-cloud",{"title":310,"path":311,"stem":312,"icon":158},"Apply a logo overlay to a running Live stream","\u002Fen\u002Fhow-tos\u002Fapply-logo-overlay","en\u002F6.how-tos\u002F5.apply-logo-overlay",{"title":314,"path":315,"stem":316,"icon":317},"Black out or replace the program on a running Live stream","\u002Fen\u002Fhow-tos\u002Fbroadcast-blackout","en\u002F6.how-tos\u002F6.broadcast-blackout","i-lucide-square",{"title":319,"path":320,"stem":321,"icon":322},"Switch the source of a running Live stream","\u002Fen\u002Fhow-tos\u002Fruntime-source-switch","en\u002F6.how-tos\u002F7.runtime-source-switch","i-lucide-repeat-2",{"title":324,"path":325,"stem":326,"icon":327},"Toggle a Publishing mid-broadcast","\u002Fen\u002Fhow-tos\u002Ftoggle-publishing-mid-broadcast","en\u002F6.how-tos\u002F8.toggle-publishing-mid-broadcast","i-lucide-toggle-right",{"title":329,"path":330,"stem":331,"icon":34},"Contribute a live signal to MediaCopilot Live","\u002Fen\u002Fhow-tos\u002Fcontribute-to-mediacopilot-live","en\u002F6.how-tos\u002F9.contribute-to-mediacopilot-live",{"title":333,"path":334,"stem":335,"children":336,"page":24},"Installation","\u002Fen\u002Finstallation","en\u002F7.installation",[337,342,347,352,357,361,365],{"title":338,"path":339,"stem":340,"icon":341},"Prepare the host","\u002Fen\u002Finstallation\u002Fprepare-host","en\u002F7.installation\u002F1.prepare-host","i-lucide-server-cog",{"title":343,"path":344,"stem":345,"icon":346},"Install C21 Live Control","\u002Fen\u002Finstallation\u002Fcontrol","en\u002F7.installation\u002F2.control","i-lucide-cloud-download",{"title":348,"path":349,"stem":350,"icon":351},"Install C21 Live Encoder","\u002Fen\u002Finstallation\u002Fencoder","en\u002F7.installation\u002F3.encoder","i-lucide-cpu",{"title":353,"path":354,"stem":355,"icon":356},"Updates","\u002Fen\u002Finstallation\u002Fupdates","en\u002F7.installation\u002F4.updates","i-lucide-refresh-cw",{"title":358,"path":359,"stem":360,"icon":215},"Licenses","\u002Fen\u002Finstallation\u002Flicenses","en\u002F7.installation\u002F5.licenses",{"title":362,"path":363,"stem":364,"icon":96},"Install C21 Live Control and C21 Live Encoder on one host","\u002Fen\u002Finstallation\u002Fcontrol-and-encoder-same-host","en\u002F7.installation\u002F6.control-and-encoder-same-host",{"title":366,"path":367,"stem":368,"icon":224},"Deployment security requirements","\u002Fen\u002Finstallation\u002Fsecurity-requirements","en\u002F7.installation\u002F7.security-requirements",{"title":370,"path":371,"stem":372,"children":373,"page":24},"Developers","\u002Fen\u002Fdevelopers","en\u002F8.developers",[374,378,396],{"title":41,"path":375,"stem":376,"icon":377},"\u002Fen\u002Fdevelopers\u002Foverview","en\u002F8.developers\u002F1.overview","i-lucide-code",{"title":379,"icon":377,"path":380,"stem":381,"children":382,"page":24},"API","\u002Fen\u002Fdevelopers\u002Fapi","en\u002F8.developers\u002F2.api",[383,386,391],{"title":41,"path":384,"stem":385,"icon":377},"\u002Fen\u002Fdevelopers\u002Fapi\u002Foverview","en\u002F8.developers\u002F2.api\u002F1.overview",{"title":387,"path":388,"stem":389,"icon":390},"Authentication","\u002Fen\u002Fdevelopers\u002Fapi\u002Fauthentication","en\u002F8.developers\u002F2.api\u002F2.authentication","i-lucide-key",{"title":392,"path":393,"stem":394,"icon":395},"Pagination and Errors","\u002Fen\u002Fdevelopers\u002Fapi\u002Fpagination-errors","en\u002F8.developers\u002F2.api\u002F3.pagination-errors","i-lucide-list-ordered",{"title":397,"icon":398,"path":399,"stem":400,"children":401,"page":24},"MCP Server","i-lucide-bot","\u002Fen\u002Fdevelopers\u002Fmcp-server","en\u002F8.developers\u002F3.mcp-server",[402,405,410],{"title":41,"path":403,"stem":404,"icon":398},"\u002Fen\u002Fdevelopers\u002Fmcp-server\u002Foverview","en\u002F8.developers\u002F3.mcp-server\u002F1.overview",{"title":406,"path":407,"stem":408,"icon":409},"Tools","\u002Fen\u002Fdevelopers\u002Fmcp-server\u002Ftools","en\u002F8.developers\u002F3.mcp-server\u002F2.tools","i-lucide-wrench",{"title":411,"path":412,"stem":413,"icon":414},"Examples","\u002Fen\u002Fdevelopers\u002Fmcp-server\u002Fexamples","en\u002F8.developers\u002F3.mcp-server\u002F3.examples","i-lucide-play",{"title":416,"path":417,"stem":418,"children":419,"page":24},"Resources","\u002Fen\u002Fresources","en\u002F9.resources",[420,425,430],{"title":421,"path":422,"stem":423,"icon":424},"Links","\u002Fen\u002Fresources\u002Flinks","en\u002F9.resources\u002F1.links","i-lucide-link",{"title":426,"path":427,"stem":428,"icon":429},"Release Notes","\u002Fen\u002Fresources\u002Frelease-notes","en\u002F9.resources\u002F2.release-notes","i-lucide-clipboard-list",{"title":431,"path":432,"stem":433,"icon":434},"Glossary","\u002Fen\u002Fresources\u002Fglossary","en\u002F9.resources\u002F3.glossary","i-lucide-book-a",{"id":436,"title":366,"body":437,"description":741,"extension":742,"links":743,"meta":744,"navigation":745,"path":367,"seo":746,"stem":368,"__hash__":747},"docs_en\u002Fen\u002F7.installation\u002F7.security-requirements.md",{"type":438,"value":439,"toc":725},"minimark",[440,448,453,456,506,509,513,520,525,528,532,535,539,551,555,558,562,602,606,612,629,633,696,700],[441,442,443,447],"p",{},[444,445,446],"strong",{},"C21 Live Control"," holds the values that let it broadcast on your behalf. Protecting them is a shared job: the product encrypts its backups and does not echo stored credentials back through the API or the assistant; the host that runs the product has to be protected by whoever deploys it. This page lists what the deployment must guarantee before production credentials go into Live Control.",[449,450,452],"h2",{"id":451},"what-live-control-stores-that-is-sensitive","What Live Control stores that is sensitive",[441,454,455],{},"Live Control stores these values as it uses them, not encrypted field by field: the encoder sends the stream key to the provider, not a hash of it. That is why the protection applies to the host as a whole rather than to each value.",[457,458,459,472],"table",{},[460,461,462],"thead",{},[463,464,465,469],"tr",{},[466,467,468],"th",{},"Item",[466,470,471],{},"What it contains",[473,474,475,486,496],"tbody",{},[463,476,477,483],{},[478,479,480],"td",{},[444,481,482],{},"Configuration database",[478,484,485],{},"Stream keys of destinations (YouTube, Twitch and the other RTMP providers), credentials of object storage destinations (S3, Azure Blob Storage), Remote Folders (NFS, WebDAV) and Target Folders (FTP, SFTP, S3), SRT passphrases of Channels and destinations, encryption keys and DRM provider credentials, and integration keys.",[463,487,488,493],{},[478,489,490],{},[444,491,492],{},"Backups",[478,494,495],{},"A dump of that database plus the installation configuration, encrypted. Everything the database holds is in every backup.",[463,497,498,503],{},[478,499,500],{},[444,501,502],{},"Installation configuration",[478,504,505],{},"Service passwords, the key that encrypts the backups, the initial credentials and the TLS private key. They live under the installation directory on the host, readable by root only.",[441,507,508],{},"Anyone who can read the host's disk, the installation directory or a backup together with its key can broadcast on your channels and reach your storage. Treat the host as a sensitive asset.",[449,510,512],{"id":511},"requirements","Requirements",[441,514,515,516,519],{},"The deployment ",[444,517,518],{},"must"," meet all four. The installer checks none of them: they are decisions about the host, taken before Live Control is installed.",[521,522,524],"h3",{"id":523},"disk-encryption-on-the-host","Disk encryption on the host",[441,526,527],{},"Encrypt the volumes that hold the installation directory, the data volumes and the backup directory: LUKS on a bare-metal or virtual host, or the volume encryption of your cloud provider (encrypted EBS volumes, Azure disk encryption and the like). Encryption at rest is what protects the database when a disk, a snapshot or a decommissioned machine leaves your control. Enable it before the installer runs: the installer does not encrypt the disk.",[521,529,531],{"id":530},"host-access-restricted-to-administrators","Host access restricted to administrators",[441,533,534],{},"Only the people who administer the platform log in to the host, each with their own account and an SSH key: no password login and no shared account. Anyone with root on the host can read the database and the backup key, so host access is equivalent to holding every stream key. Keep the list of host administrators as short as the list of System Administrators in Live Control.",[521,536,538],{"id":537},"the-database-is-not-exposed-outside-the-host","The database is not exposed outside the host",[441,540,541,542,546,547,550],{},"The installer keeps the database on the stack's internal Docker network and does not publish its port. Do not publish the database port, do not point remote database clients at it and do not open it to other hosts for reporting. Everything that needs the data reaches it through the Live Control API. Remember that ports published by Docker are not filtered by ",[543,544,545],"code",{},"ufw"," (see ",[548,549,338],"a",{"href":339},").",[521,552,554],{"id":553},"off-host-copies-of-backups-stay-encrypted-and-restricted","Off-host copies of backups stay encrypted and restricted",[441,556,557],{},"Backups are encrypted on the host with a key that lives in the installation configuration. If you copy them elsewhere (an object store, a backup server, a vault), keep them encrypted, keep that key apart from the copies and restrict who can read them, with the same rules as the host itself. A backup plus its key is the whole database.",[449,559,561],{"id":560},"what-the-product-already-does","What the product already does",[563,564,565,576,586],"ul",{},[566,567,568,571,572,575],"li",{},[444,569,570],{},"Automatic backups are encrypted."," The installer schedules a daily backup, encrypted with AES-256, with 7 days of retention by default. See ",[548,573,492],{"href":574},"\u002Fen\u002Finstallation\u002Fcontrol#backups"," on the Control installation page.",[566,577,578,581,582,585],{},[444,579,580],{},"Installation files are readable by root only."," The configuration, the initial credentials, the TLS private key and the backup directory are created with restricted permissions, and the CLI runs with ",[543,583,584],{},"sudo",".",[566,587,588,591,592,595,596,598,599,585],{},[444,589,590],{},"Stored credentials are not echoed back."," The API returns the sentinel ",[543,593,594],{},"••••••••"," in place of a stored destination credential (Target Folders report only whether a password is set), and the MCP server hands the assistant a fingerprint of a stream key instead of its value. See ",[548,597,121],{"href":126}," and ",[548,600,601],{"href":407},"MCP tools",[449,603,605],{"id":604},"recommendations","Recommendations",[441,607,515,608,611],{},[444,609,610],{},"should"," also:",[563,613,614,620],{},[566,615,616,619],{},[444,617,618],{},"Rotate the stream keys"," of every destination if a host, a disk image or a backup may have been exposed. YouTube, Twitch and the other providers let you reset the key from their studio; then update the destination in Live Control.",[566,621,622,625,626,628],{},[444,623,624],{},"Review periodically who holds the System Administrator role"," in ",[548,627,139],{"href":144},", together with the API tokens issued to those accounts. Administrators manage destinations and their credentials; an unused administrator account is a standing risk.",[449,630,632],{"id":631},"shared-responsibility","Shared responsibility",[457,634,635,645],{},[460,636,637],{},[463,638,639,642],{},[466,640,641],{},"Cires21 (the product)",[466,643,644],{},"You (the deployment)",[473,646,647,655,663,671,679,689],{},[463,648,649,652],{},[478,650,651],{},"Encrypts the automatic backups and keeps them on the host.",[478,653,654],{},"Encrypts the host's disks before installing.",[463,656,657,660],{},[478,658,659],{},"Creates the installation files with root-only permissions.",[478,661,662],{},"Restricts host access to named administrators with SSH keys.",[463,664,665,668],{},[478,666,667],{},"Keeps the database on the stack's internal network and exposes the data only through the API.",[478,669,670],{},"Keeps the database port closed and filters the published ports.",[463,672,673,676],{},[478,674,675],{},"Does not echo stored credentials back through the API or the assistant.",[478,677,678],{},"Protects every off-host copy of a backup as it protects the host.",[463,680,681,684],{},[478,682,683],{},"Publishes security fixes as product updates.",[478,685,686,687,550],{},"Applies product updates and the host's OS security updates (see ",[548,688,353],{"href":354},[463,690,691,693],{},[478,692],{},[478,694,695],{},"Rotates keys after an exposure and reviews the administrator list.",[449,697,699],{"id":698},"cross-links","Cross-links",[563,701,702,710,715,720],{},[566,703,704,706,707,709],{},[548,705,338],{"href":339}," — DNS, NTP, ",[543,708,545],{},", swap before the install.",[566,711,712,714],{},[548,713,343],{"href":344}," — backups, SSL and the security commands of the CLI.",[566,716,717,719],{},[548,718,139],{"href":144}," — roles and API tokens.",[566,721,722,724],{},[548,723,152],{"href":153}," — sessions, lockout and password policy of the instance.",{"title":726,"searchDepth":727,"depth":727,"links":728},"",2,[729,730,737,738,739,740],{"id":451,"depth":727,"text":452},{"id":511,"depth":727,"text":512,"children":731},[732,734,735,736],{"id":523,"depth":733,"text":524},3,{"id":530,"depth":733,"text":531},{"id":537,"depth":733,"text":538},{"id":553,"depth":733,"text":554},{"id":560,"depth":727,"text":561},{"id":604,"depth":727,"text":605},{"id":631,"depth":727,"text":632},{"id":698,"depth":727,"text":699},"What C21 Live Control stores that is sensitive and what the host that runs it must guarantee — disk encryption, restricted access, a database that stays on the host and encrypted off-host backups.","md",null,{},{"icon":224},{"title":366,"description":741},"zubIUIY7akchN-M3URKfpaQuHRWRs4EIxorKDncT-fU",[749,751],{"title":362,"path":363,"stem":364,"description":750,"icon":96,"children":-1},"Run C21 Live Control and C21 Live Encoder on a single host — port layout, install order, the move of Control to port 9443, licenses, certificate, firewall and the impact of updates.",{"title":41,"path":375,"stem":376,"description":752,"icon":377,"children":-1},"Build against C21 Live Control — the REST API at \u002Fc21apiv2 and the MCP server, both behind one bearer token.",1794309678853]