Zero-Knowledge Video Conferencing for High-Trust Collaboration

What "SFU" Means in Everyday Terms: In a basic 15-person peer-to-peer call, your computer must upload your camera stream 14 separate times—choking home Wi-Fi and draining battery. A Selective Forwarding Unit (SFU) is a high-speed relay server: your device uploads your encrypted stream once to the SFU, which forwards copies to everyone else in the room in sub-150ms.

Why the Server Still Can't See or Hear You (Zero-Knowledge SFrame E2EE): Before camera or microphone data leaves your device, CipherMeet locks every individual audio frame and video NAL unit using the IETF SFrame standard with a hardware-accelerated AES-128-GCM encryption key held only by participants in your room. The SFU acts like a courier sorting locked titanium boxes—it routes packets to the right room but can never open, view, mix, or record them.

Step 1 — Create an Organization on The Foundry: Sign in at foundry.failsafe.studio/org.html and click + New Organization. You can toggle between Live Mode (cm_hk_live_*) for real meetings and Sandbox Mode (cm_hk_test_*) for testing integrations without spending real money.

Step 2 — Top Up Your Prepaid Wallet: Visit foundry.failsafe.studio/wallet.html and add between $5.00 and $2,500.00 via Stripe.

Step 3 — Generate Named Host Keys with Optional Monthly Caps: On the Team & Host Keys page, enter a descriptive label (such as "Engineering Standups" or "Friend — Alex's Host Key") and an optional Monthly Spending Cap in USD (for example, $15/mo), then click Generate Host Key.

One-Time Secret Display (HMAC-SHA256 Protected): Your full Host Key is shown once only at creation. Our database never stores the raw key—only an HMAC-SHA256 hash and a short prefix (cm_hk_live_a1b2…). Save it in your password manager and paste it into CipherMeet when starting a hosted room.

Sharing Keys & Independent Per-Key Caps: Issue separate Host Keys to teammates, clients, or friends under one shared wallet. Each key tracks its own sessions and monthly spend independently (adjustable anytime via Set Cap). If a key hits its monthly cap, it enters edges_closed for the rest of the month while your wallet and other keys keep working.

Guarded Safety Switch for Permanent Revocation: If a key is lost or a contractor leaves, click Revoke on org.html. A Guarded Safety Switch modal requires flipping an explicit arming toggle (Safety Guard: LOCKED → ARMED) before Confirm Revoke Key unlocks, permanently blocking the key.

What is a Participant-Minute? 5 people in a call for 10 minutes equals 5 × 10 = 50 participant-minutes. You only pay for the exact minutes each person is connected.

Why We Measure in "Micro-Cents" (1 cent = 1,000,000 ucents): Because 1 minute of audio costs one-tenth of a cent ($0.0010), two-decimal billing would round every minute up to a full penny (10× overcharge). Our ledger tracks integer micro-cents (ucents) where 1 cent = 1,000,000 ucents ($1.00 = 100,000,000 ucents) with zero rounding error.

The 3 Media Class Rates (Highest Active Track Wins): Rates never stack on the same participant—each minute is billed strictly at that participant's single highest active media track (video > screenshare > audio):

• Voice / Audio Only ($0.0010 / participant-min = 100,000 ucents): Participant is speaking or listening with no camera or screen share active (e.g., 20 people for 60 minutes = $1.20 total).
• Screenshare + Audio ($0.0025 / participant-min = 250,000 ucents): Participant is sharing their screen without camera video.
• HD Video + Audio ($0.0040 / participant-min = 400,000 ucents): Participant has camera video enabled (includes audio and screenshare at no extra charge).

FIFO Credit Lots & Top-Up Surcharge Tiers: Every top-up creates a FIFO (First-In, First-Out) Credit Lot—usage always draws down from your oldest active lot first. Larger top-ups reduce the platform draw-down surcharge: Starter ($5–$99.99: +20%), Team ($100–$499.99: +15%), Scale ($500–$2,499.99: +10%), and Enterprise ($2,500+: +5%). Every session generates an itemized receipt and immutable ledger entry exportable via Export Ledger CSV.

Zero-Drop Mid-Call Continuity Policy: CipherMeet is engineered so an active meeting never abruptly cuts off mid-sentence if your prepaid wallet reaches $0.00:

• Optional Off-Session Auto-Reload: Off by default. On wallet.html, you can configure Auto-Reload with a custom trigger threshold (UI range $5–$1,000, pre-filled at $15; backend default $10.00) and reload amount (UI range $20–$2,500, pre-filled at $100; backend default $25.00, minimum $5.00). Strictly limited to max 3 reloads per 24 hours and automatically pauses on card decline.
• 120-Minute Mid-Call Overage Grace Window (+20%): If Auto-Reload is disabled (or fails) and your balance hits $0.00 during a live call, the session continues uninterrupted in Overage State (+20% surcharge) for up to 120 minutes (2 hours by default, configurable per wallet via overage_window_s), protected by an absorbed overage ceiling starting at $25.00 by default (max($25.00, 20% of last top-up), up to $100.00 or configurable down to $0.00).
• Smart Roster Reconnects (edges_closed): Once the 120-minute overage window elapses or a cap is reached, the room closes admission to brand-new attendees while still allowing the host and active participants from the last 10 minutes to reconnect if their Wi-Fi drops.
• 15-Minute Final Wrap-Up Countdown (capped): If the hard negative overage ceiling is reached, an in-call banner provides a clear 15-minute final wrap-up countdown (min(room_started_at + 8h, cap_hit_at + 15m)) so everyone can conclude gracefully.

AES-256-GCM Encrypted Billing Alerts & 30-Day Untouched Lot Refunds: Configure up to 5 Email and 5 SMS (+E.164) alert contacts on org.html (encrypted at rest via AES-256-GCM). Any prepaid credit lot that remains 100% untouched (remaining == net) within 30 days of purchase shows a one-click Refund Lot button on wallet.html for an instant full Stripe refund.

Sovereign On-Premise & Private VPC Deployment: Organizations requiring complete physical custody of their media relay routing can deploy the CipherMeet SFU stack inside their own data centers, Kubernetes clusters, or air-gapped networks using organization-owned Ed25519 perpetual commercial licenses issued on The Foundry.

Offline Cryptographic Verification & Immutable @sha256 Release Digests: Self-hosted SFU nodes verify license tokens entirely offline via @failsafe/verify and signed Certificate Revocation List (CRL) envelopes—requiring zero continuous phone-home telemetry. Every container release on the stable and beta channels is signed with Ed25519 over canonical JSON and enforces immutable @sha256:<64-hex> image digests so mutable container tags can never be tampered with.

Self-Healing Diagnostics & SLA Audit Console: Operators can link sanitized CM-DIAG-* diagnostic bundles directly to support cases at foundry.failsafe.studio/support.html, track live SLA countdown clocks, and trigger immediate engineering escalation on Priority licenses.