WebRTC Data Management Platform

Challenge

A healthcare SaaS client needed HIPAA-aligned real-time data sync between clinicians with no server-side decryption of payload content — only metadata routing.

Solution

Designed a signaling server on NestJS with TURN/STUN on AWS, implemented DTLS-SRTP data channels with client-side AES-256 encryption, and built a React dashboard for session audit trails without exposing plaintext.

Regulatory pressure

Clinicians needed real-time collaboration. Compliance required that clinical payload bytes never decrypt on infrastructure the vendor operated — only on endpoints.

Technical approach

NestJS signaling with TURN on AWS. DTLS-SRTP data channels with client-side AES-256. Audit UI surfaced session metadata and connection health without displaying message bodies.

Verification

Third-party penetration test on first submission. Architecture documentation mapped trust boundaries for the customer's security team.

Impact

• ▸Zero plaintext data at rest on servers
• ▸Sub-200ms P2P sync latency in EU regions
• ▸Passed third-party security audit on first review

Lessons learned

• ▸Threat modeling beats feature velocity in regulated domains.
• ▸Signaling servers are metadata routers — treat them as sensitive audit surfaces.
• ▸Latency budgets matter when clinicians work under time pressure.

Stack