Skip to content

Iristick.Assist IT & Security Brief

A single-page reference for IT administrators and security reviewers. Use your browser's Print → Save as PDF to download this brief as a document you can attach to a ticket or share offline.

The latest online version lives at docs.iristick.com/solutions/assist/security-brief/.

1. What Iristick.Assist Is

Iristick.Assist is an Android and iOS app. It streams a fieldworker's point of view from Iristick smart glasses to a remote expert, who joins from a browser. It is used for remote support, inspection, and guidance.

  • No accounts. Neither side creates an Iristick account. Access is room-based.
  • No expert-side install. The expert joins at assist.iristick.app in a standard browser.
  • No media through Iristick. Audio, video, and photos travel directly between the two devices.
  • No storage. Nothing from a session is retained after it ends.

2. Architecture

Assist is built on WebRTC, the open standard for real-time communication. Iristick's infrastructure is involved in session setup only.

  1. Signaling. Clients exchange session metadata (SDP) through the Iristick signaling server to find each other. HTTPS / TLS 1.2+.
  2. ICE candidate exchange. The clients work out the best route for a direct connection. STUN/TURN helps when firewalls block direct access.
  3. Peer-to-peer media. Encrypted audio and video flow directly between devices. Iristick is no longer in the path.
flowchart LR
    A[Field worker] -->|Signaling only| B[Iristick Server]
    C[Remote expert] -->|Signaling only| B
    A <-->|Encrypted P2P media| C

When network conditions force traffic through a TURN relay, the relay forwards encrypted packets it cannot read. Media remains end-to-end encrypted in every path.

For the full handshake, including the direct and TURN-relayed paths side by side, see Connection Establishment Step by Step.

3. Network Requirements

Purpose Protocol and port Direction
STUN/TURN, establishing and relaying the media path UDP 3478 Outbound
Fallback when UDP is blocked, and all signalling TCP 443 (HTTPS/TLS) Outbound

No inbound ports are required. All connections are established outbound from the client. Where UDP 3478 is blocked, calls still connect over 443 at the cost of some latency.

4. Encryption

Layer Protection
Audio, video, photos DTLS-SRTP with ephemeral per-session keys
Signaling HTTPS / TLS 1.2+
Key lifetime Generated per session, held only on the two devices, destroyed at session end

No party, Iristick included, can decrypt session media.

5. Access Control

Sessions are room-based. The room locks automatically once the fieldworker and the first expert are connected. From that point the room code no longer works. The only way in is a tokenised invitation link issued from inside the call.

Invitation links can be revoked by the main expert and expire on their own. Removed participants cannot rejoin the same room. A session holds one fieldworker plus a maximum of three experts.

6. Data Handling

What Stored on Iristick servers Stored on devices
Audio No No
Video No No
Photos taken during a call No Only during the active session
Signaling metadata No, transient only No

Photos are deleted from both devices as soon as the call ends. There is no way to recover them. That is by design.

Iristick collects anonymous usage data only, for abuse prevention and service improvement. No personally identifiable information, no location data, no device IDs, no profiling, no advertising, no resale. All usage data is stored and processed within Europe.

7. Infrastructure

Component Managed by Protected with
Signaling server Iristick TLS 1.2+
STUN/TURN servers Iristick End-to-end encryption (DTLS-SRTP)
Media routing None, direct peer-to-peer DTLS-SRTP with ephemeral keys

Development, staging, and production systems are strictly separated to prevent unauthorised access or data leakage.

8. Supported Platforms

Side Requirement
Fieldworker Android or iOS app from Google Play or the App Store, paired with Iristick smart glasses
Expert Any modern WebRTC-capable browser (Chrome, Edge, Firefox, Safari) on desktop, tablet, or phone
Permissions Camera and microphone access, granted by the user on both sides

9. Licensed Features

Calls, audio, the pointer, photo capture, saved rooms, and voice commands work without a license. Four features need one: screen sharing, drawing, inviting extra experts, and face blurring. See licensing.

10. Comparison with Iristick.Teams

Iristick.Assist Iristick.Teams
Connection model Peer-to-peer (WebRTC) Azure Communication Services
Media through Iristick servers Never Never. Always through Microsoft Azure Communication Services.
Data stored by Iristick Anonymous usage data only User info + call summaries
Encryption DTLS-SRTP (end-to-end) TLS 1.2+ (in transit), AES-256 (at rest)
Authentication Room-based, no account required Microsoft Entra ID via MSAL

For the Teams security model in full, see Iristick.Teams Permissions, Data & Security.

Questions? Contact support@iristick.com. The full documentation lives at docs.iristick.com.