HAMAWhy public conferencing is risky for government
Zoom, Google Meet and similar cloud services are built for speed and convenience, but their architecture assumes mass usage rather than secrecy. When you hold a confidential meeting, questions like these become pressing:
- Where is the media processed? Audio and video are usually relayed through the provider's overseas servers and in many cases decrypted there.
- Who can listen? If the server can see the media stream, both the provider and authorities in its jurisdiction can technically access it.
- Who holds the metadata? Who talked to whom, when and for how long — that alone is sensitive information.
- Where are recordings stored? A recording in the cloud leaves the organization's control.
For meetings discussing state secrets or restricted information, these risks are unacceptable.
How media stream encryption works
Protection in a video conference consists of several layers, and it is important to tell them apart.
Transport-layer encryption
Audio/video is encrypted via DTLS/SRTP, and signaling via TLS (HTTPS/WSS). This prevents stream interception (sniffing) on the network — the mandatory minimum for modern conferencing.
Server-side processing
In multi-party conferences a media server (SFU) receives streams and distributes them to everyone else. At this stage the stream may be open on the server — which is why where that server sits matters.
End-to-end encryption (E2EE)
The highest level, but it limits many server-side features (recording, transcription). In practice many organizations strike a balance by placing the media server in their own trusted perimeter: the stream is encrypted, and the server stays under control.
The key point: encryption alone is not enough — what matters is who holds the key and the server. If the media server belongs to an overseas provider, encryption does not protect you from that provider itself.
Self-hosted / on-premise conferencing
The most reliable way to protect confidential communication is to bring the media server under the organization's control. This can be done in two ways:
- On-premise. The server sits in the organization's own data center — full physical control.
- Secure in-country hosting. The server is placed in trusted infrastructure on Uzbekistan's territory — local jurisdiction and low latency.
In both cases the media stream and metadata never leave the organization's perimeter, dependency on an external cloud disappears, and data sovereignty is preserved. This is a baseline requirement for government bodies and critical business.
Access control and recording management
Encryption does not decide who gets inside the conference — that needs a separate control layer:
- Authentication. Only confirmed employees should be able to join a meeting — for example, via JWT tokens or the platform's single account system.
- Room rights. Who is a participant, who is a moderator, who may share the screen — restriction by role.
- Recording control. It must be clearly defined who authorizes recording, where it is stored and who can view it.
- Audit log. If who joined and left and when is recorded, an audit becomes possible later.
Access and recording control is precisely the weakest point of public services: if a link leaks, outsiders can end up in the meeting.
Criteria for choosing secure conferencing
When evaluating a solution intended for confidential communication, check it against the following criteria:
- Hosting location. Is in-country or own-infrastructure deployment possible?
- Encryption. Media (DTLS/SRTP) and signaling (TLS) are encrypted.
- Authentication. Strict access control (for example, JWT) and role-based management.
- Recording and audit. Recording control, storage location and an audit log.
- White-label. The ability to run under your own brand.
- Independence. No dependency on an external cloud or overseas providers.
How HAMA handles this
HAMA is a unified secure platform for organizations in Uzbekistan, and it includes a self-hosted video conferencing module. The conferencing is built on a Jitsi/SFU architecture and is deployed not in an external cloud, but on a secure server on Uzbekistan's territory or within the organization's own infrastructure.
Conferences are protected by JWT authentication — only confirmed platform users can join a meeting. Media and signaling are protected through TLS and media stream encryption, and the platform itself is white-label, running under the organization's brand. That way the media stream and metadata never leave the perimeter, and data sovereignty is preserved. Learn more: Zoom alternative — HAMA video.