Data flow diagram
What data Cliqer moves, over which channels, how it is encrypted and where it is stored.
Data flow diagram
This page describes every data flow in Cliqer, the protocol and encryption used on each, and what is stored versus what stays transient. It is written for security and procurement reviews. For the component-level view, see the Solution blueprint. For firewall rules and ports, see Security & Networking.
Diagram
Flows
| # | Flow | Channel | Encryption in transit | Data carried | Stored? |
|---|---|---|---|---|---|
| 1 | Sign-in and dashboard | HTTPS (TLS 1.2+) | TLS | Credentials or passkey assertion, profile (name, email), team, licence and subscription records | Yes - account platform |
| 2 | SSO (optional) | HTTPS, OIDC authorization code flow | TLS | Identity claims from your IdP (email, name). With "Require SSO" enabled, no passwords are handled by Cliqer | Identity link only |
| 3 | SCIM (optional) | HTTPS, bearer token minted by your team | TLS | Member create / update / deactivate events from your IdP | Yes - team membership |
| 4 | Room signaling | WSS (TLS 1.2+) | TLS | Room ID, display names, peer IDs, presence, connection metadata. No presentation content | Transient coordination state |
| 5 | Session control and media | WebRTC, direct peer to peer | DTLS 1.2, SRTP | Slide commands, pointer position, timer state, camera / screen streams | No - never stored, never touches application servers |
| 5b | Relay fallback | WebRTC via TURN (UDP/TCP/TLS) | DTLS 1.2, SRTP | Same as flow 5. The relay forwards encrypted packets and cannot decrypt them | No |
| 6 | Payments | HTTPS to processor-hosted pages | TLS | Card data goes to the payment processor only (PCI DSS Level 1). Cliqer stores subscription and invoice metadata, never card numbers | Metadata only |
| 7 | Team / support chat | HTTPS + WSS | TLS | Messages and file attachments | Yes - account platform |
| 8 | Transactional email | SMTP / HTTPS from platform | TLS | Receipts, team invites, security notifications | Send log only |
| 9 | Operational telemetry | HTTPS | TLS | Connection events (timestamps, room ID, connect / disconnect outcome) used for service reliability. No session content | Yes - operations store |
Key properties
- Presentation content stays on your devices. Slides are never uploaded to Cliqer. What travels between participants is control commands and, when you enable them, camera or screen streams - always over encrypted WebRTC.
- Media and control are encrypted end to end between participants with DTLS-SRTP. The TURN relay used on locked-down networks forwards encrypted packets without the keys to decrypt them. Application servers are never in the media path.
- Signaling carries coordination metadata only - who is in the room and how to reach them, not what is being presented.
- No card data on Cliqer systems. Checkout and the billing portal are hosted by our payment processor.
- All server communication is TLS. There is no unencrypted listener; HTTP redirects to HTTPS, and WebSocket connections are WSS only.
Storage and third parties
| Store / party | Role | Data |
|---|---|---|
| Cliqer account platform | System of record | Accounts, teams, licences, subscriptions, chat messages and attachments |
| Edge infrastructure provider | Global network, realtime infrastructure, STUN/TURN, storage (encrypted at rest) | Traffic transit, coordination state, uploaded assets, operational telemetry |
| Payment processor | PCI DSS Level 1 | Card and payment data |
| Your identity provider (optional) | SSO and SCIM source | Identity claims, membership lifecycle |
Questions from a vendor security review we have not answered here - use the contact form and we will respond directly, including the named subprocessor list under NDA.