Mediabriz Conversation Intelligence Security Architecture

Security Overview

This page describes how Mediabriz Conversation Intelligence operates, what data it processes, how that data is stored, and the security controls in place. It does not cover License Manager for Genesys Cloud, a separate solution in the Mediabriz family. For License Manager, see Section 20 of our Data Processing Agreement.

Mediabriz Conversation Intelligence uses a layered security approach:

• Client-side browser extension (no system installation)
• Designed with no inbound network exposure
• All communication over HTTPS (TLS 1.2 or higher)
• Uses existing Genesys Cloud authentication and permissions
• Browser access limited to Genesys Cloud and Mediabriz service domains
• Data scoped per organization and user, and stored in the organization’s data region (US or EU)
• Not designed to access local files or unrelated browser data
• AI features run only when an agent requests them, and every result is reviewed by the agent
• Encrypted data storage, with automatic expiration of temporary data

Mediabriz is designed to operate within the user's existing environment and security boundaries.

Mediabriz is not designed to introduce additional access to customer data beyond what is already available within the user's existing environment. Conversation data is shared with other systems only through Conversation Actions deliveries that your organization configures and an agent approves.

While CloudBriz implements reasonable technical and organizational measures to protect the Service and its data, no system can be guaranteed to be completely secure. Security also depends on third-party platforms, browser environments, and customer configurations.

Certain features may be configurable or disabled by the organization through available settings, allowing control over how the Service is used. This may include control over optional capabilities such as search, PDF export, and file downloads, managed centrally through browser policy (see the Enterprise Deployment Guide).

How Mediabriz Operates

Mediabriz is a browser-based application that integrates with Genesys Cloud services. It operates as a browser extension that integrates with Genesys Cloud and may also be used within supported custom web environments configured by the organization.

• The extension operates in supported contexts, including active interactions, search functionality, and user-managed content views
• It interacts with media available to the authenticated user (images, videos, audio, documents)
• It is not designed to edit or delete existing conversations, recordings, or files in Genesys Cloud
• Mediabriz is designed to access conversations and media available to the authenticated user based on their permissions in Genesys Cloud
• When an agent sends a reply from Mediabriz, the reply is sent from the agent’s browser directly to Genesys Cloud under the agent’s own Genesys Cloud permissions. The reply text is not received or stored by Mediabriz, except when the agent asks Mediabriz to draft or improve a reply with AI Reply: then the conversation’s text messages, and the agent’s unsent draft when improving, are sent to the AI model for that request only and are not stored
• All communication between the extension and Mediabriz uses HTTPS

The extension is designed to operate without altering the underlying functionality of host applications and is not designed to modify application data or workflows, other than actions a user explicitly takes, such as sending a reply or approving a Conversation Action. Any other interaction with the page is intended to be limited to user interface enhancements provided by the Service.

Mediabriz is designed to operate only within approved application domains and is not intended to access unrelated websites, browser history, or local user files.

Browser Permissions

• Approved at installation: Mediabriz requests browser access to Genesys Cloud and Mediabriz service domains only. The browser grants this access when the extension is installed, with no further prompt for installs managed by browser policy
• Optional custom domains: Access to any other site is optional and is used only for custom domains your organization configures. Each user allows it once from the extension settings, and it is never granted automatically
• Minimal browser capabilities: Beyond site access, the extension uses only the browser capabilities it needs to store its settings, sign in, display its interface, and save files a user chooses to download

See the Enterprise Deployment Guide for permission details and managed deployment.

Data Handling

Media may be accessed and processed as required for functionality, including background operations and real-time interaction handling.

• On-demand and background access: Media is fetched as required for display, processing, or other service functionality
• Contextual scope: Functionality may operate across multiple contexts, including active interactions and other user-initiated workflows such as search or historical views. Media is not intended to be aggregated or indexed beyond what is necessary for the Service
• Derivative content and temporary copies: Original media files remain in Genesys Cloud. Mediabriz generates derivative content (thumbnails, document previews) when required for the Service, and may hold short-lived temporary copies of files for security scanning or for file deliveries an agent approves. Temporary copies are deleted automatically
• User-generated metadata: Mediabriz may generate and store user-generated metadata associated with media items or interactions. This metadata is created and maintained within Mediabriz and is not sourced from or written back to Genesys Cloud. It is not intended to modify or alter the original media or conversation data
• On-device translation: Message translation uses the translator built into the agent’s browser and runs on the agent’s device. Text being translated is not sent to Mediabriz

Processing occurs in response to user activity or system events and is limited to what is necessary to provide the Service.

Mediabriz is not designed to store or take ownership of customer conversation data. Core interaction data remains within Genesys Cloud.

AI Processing (Conversation Actions)

Conversation Actions is an optional capability that helps agents turn a conversation into a structured draft, such as an order or a return, for review and approval before it is sent to the organization’s own systems. With AI Reply, an agent can also ask for a suggested reply in the reply box. It uses the conversation’s text messages, and the agent’s unsent draft when improving, never photos or files, and it reaches the customer only when the agent selects Send. Nothing sends it automatically. When used:

• Agent-initiated only: Analysis runs only when an agent explicitly requests it. There is no automatic or background analysis
• Regional processing: Conversation text, any images the agent explicitly selects, and the agent’s unsent draft when improving a reply with AI Reply, are analyzed by AI inference services provided by Amazon Web Services in regions that match the organization’s data region: US regions for US organizations and EU regions for EU organizations
• Not stored or used for training: The analyzed text, images, and resulting draft or suggested reply are processed transiently, are not stored by Mediabriz, are not retained by the model service, and are not used to train models
• Human review: AI output is validated before it reaches the agent, and the agent reviews and approves every draft before anything is sent. The AI is not designed to submit, send, or change data on its own
• Scanned images only: When Mediabriz Guard is enabled, only images that passed the security scan can be included in an analysis

Conversation Actions Deliveries

Conversation Actions deliver approved orders, returns, and files to a system your organization configures, such as a CRM or order system.

• Approved deliveries only: A delivery is sent only to an endpoint configured by your organization’s administrator, and only after an agent approves it
• Signed and encrypted in transit: Deliveries use HTTPS and carry a signature your system can verify, confirming the delivery came from Mediabriz and was not altered
• Public endpoints only: Mediabriz is designed to deliver only to public HTTPS endpoints and to refuse private or internal network destinations
• Protected credentials: Endpoint credentials are encrypted at rest and cannot be viewed after they are saved
• Send Files: An agent can select files shared in the conversation and approve sending them to your system. Each approved file is copied to storage in your organization’s data region and made available through a download link that expires after 24 hours, after which the copy is deleted automatically. When Mediabriz Guard is enabled, only files that passed the security scan are sent
• Minimal records: Mediabriz keeps a minimal record of each submission for audit and duplicate prevention. It does not include message content, customer details, or file content

Data Storage

Data is stored only as necessary to support the Service and is subject to controlled retention and automatic deletion policies. Stored data may include:

• Thumbnails and document previews: generated derivative content, subject to limited retention with automatic deletion
• Temporary file copies: files held briefly for security scanning or for approved file deliveries, deleted automatically
• Scan results: if Mediabriz Guard is enabled, the scan result for each file, retained for up to one year
• User annotations: notes, highlights, and follow-ups created by users, retained for a limited period with automatic deletion
• Action submission records: if Conversation Actions is used, a minimal record of each submission (identifiers, item counts and ordered product codes, and the approving agent), with no message content or customer details
• Organization configuration: settings and preferences, including Conversation Actions configuration, retained while the subscription is active
• Authentication data: token hashes handled using secure practices under normal operating conditions, with short-lived automatic expiration
• Billing data: aggregate organizational usage counts that do not contain personal data

See our Privacy Policy and Data Processing Agreement for data handling and retention details. A detailed retention schedule is available on request.

What Is NOT Stored

• Mediabriz is not designed to store original media files permanently
• Message history is not designed to be stored by the Service. When Conversation Actions is used, conversation text is analyzed transiently and not stored
• Replies sent from Mediabriz are not designed to be received or stored by the Service, except when the agent asks Mediabriz to draft or improve a reply with AI Reply: then the conversation’s text messages, and the agent’s unsent draft when improving, are sent to the AI model for that request only and are not stored. Only usage counts are recorded
• Customer personal data does not intentionally get collected or stored beyond what Genesys Cloud provides in the interaction context. Details included in an approved Conversation Actions delivery are passed to your organization’s system and are not stored by Mediabriz
• OAuth tokens are handled using secure practices and the Service does not intentionally retain them in plaintext

Temporary data is subject to automatic expiry via lifecycle rules. See our Data Processing Agreement for retention details.

Data Regions

Each organization is assigned a data region, US or EU, during onboarding. Data is designed to be stored and processed within that region, including AI processing and file deliveries. Office document previews are the exception, as described under Service Providers below. Aggregate billing counts that do not contain personal data may be processed outside the region for reporting.

Service Providers

• Amazon Web Services (AWS): cloud infrastructure, hosting, and security scanning, and AI inference for Conversation Actions when used
• Genesys Cloud: the required platform for authentication, conversation data, and delivery of agent replies
• Microsoft: rendering of Office document previews, performed on Microsoft’s global infrastructure. Blocking view.officeapps.live.com disables Office previews without affecting other functionality

See the Data Processing Agreement for the full list of sub-processors.

Security Controls

Encryption

• In transit: All communication is designed to use HTTPS with TLS 1.2 or higher
• At rest: Stored data is encrypted using managed encryption keys with automatic key rotation
• Secrets: Sensitive credentials, such as sign-in configuration and Conversation Actions endpoint credentials, are encrypted using managed key services and are not returned in plaintext by the Service
• Browser storage: OAuth tokens are stored in browser extension storage, which is designed to be inaccessible to web pages or external sites under normal browser operating conditions

Access Control

• Authentication required: Data-access endpoints are designed to require a valid API key and a verified Genesys Cloud OAuth token. File-delivery download links are the one exception: each link works for a single file and for a limited time, so your organization’s system can retrieve it without signing in
• Organization scoping: Requests are scoped to the authenticated user's organization. Cross-organization access is restricted by design
• Organization status enforcement: Access is restricted to organizations with active or trial subscriptions. Suspended or cancelled organizations are blocked
• Administrative analytics: Access to the Mediabriz Insights dashboard is restricted to users granted the corresponding Genesys Cloud permission and remains scoped to that user’s organization
• Request validation: All API requests are subject to multi-layer authentication and authorization checks

Media Access

• Media cache storage is private by design. Public access is restricted
• Media is designed to be accessible through the CDN using access controls
• The extension is not designed to access storage directly
• HTTPS is designed to be enforced on both storage and CDN layers

Infrastructure Protection

• Web Application Firewall (WAF): API endpoints are protected with per-IP rate limiting, OWASP core rules, known bad input patterns, and IP reputation blocking
• DDoS protection: Layer 3/4 protection is active on endpoints
• API throttling: Rate and burst limits are designed to reject excessive requests
• Network isolation: Service functions run in isolated environments with least-privilege access. Images and videos are converted into thumbnails and analysis images in a separate, sealed environment with no internet access
• Logging and monitoring: Service invocations are logged. Monitoring alarms are configured for anomalous traffic
• Log sanitization: Tokens, secrets, and API keys are designed to be sanitized from logs

Optional Security Add-ons

Mediabriz Guard (Media Scanning)

Mediabriz Guard is an optional add-on that submits media files shared in conversations for malware scanning before they can be opened in the extension. When enabled for an organization:

• Files are scanned by Amazon GuardDuty Malware Protection prior to delivery
• Scan results are kept per file and organization for up to one year, so the same file is not re-scanned on each access
• Only files with a clean scan result can be previewed, downloaded, or sent to other systems. Files that are infected, still being scanned, or could not be scanned remain blocked and are surfaced with a visible scan-status indicator in the user interface
• Gallery thumbnails remain visible for every file. A thumbnail is a newly generated image and never the original file
• Scan results are recorded per organization for reporting and billing
• Optional secure file delivery, available on request: Mediabriz delivers files that passed the scan directly to agents, so your organization can block direct file downloads from Genesys Cloud at its firewall

Mediabriz Guard is a supplementary security measure. It is not designed to replace endpoint security, antivirus, or enterprise cybersecurity controls, and CloudBriz does not warrant that all malware, viruses, or malicious content will be detected. The scanning service relies on third-party malware-detection technology and is subject to the detection capabilities and limitations of that technology.

For the complete scanning-service disclaimer and limitation of liability, see EULA §12.1.

Network Requirements

Mediabriz requires outbound HTTPS access to its service endpoints, in addition to the standard Genesys Cloud network access your organization already has in place. Both are required for Mediabriz to function, and no changes are needed to your existing Genesys Cloud connectivity.

Mediabriz is not designed to require any inbound firewall rules, ports, or network exposure.

Organizations with restrictive firewalls or web proxies must allow outbound HTTPS (port 443) to the Mediabriz domains listed below. All non-EU-prefixed Mediabriz domains and the Microsoft Office Online viewer apply to every organization. The EU domains are only required for organizations whose data is hosted in the EU data region. Organizations in the US data region do not need them. If you’re unsure which domains apply to your organization, contact Mediabriz support.

Real-time updates (WebSocket). Genesys Cloud delivers conversation notifications over an outbound secure WebSocket connection to streaming.{region} (port 443). This channel is part of the existing Genesys Cloud connectivity referenced above; if your firewall enforces outbound WebSocket (WSS) rules separately from HTTPS, ensure WSS to streaming.{region} is allowed for your organization’s Genesys Cloud region (for example, streaming.mypurecloud.com for US East).

Iframe note. Loading a domain in an iframe still counts as outbound HTTPS from the browser to that domain: the iframe wrapper is an HTML container, not a network proxy. Strict outbound-allowlist firewalls must include wizard.mediabriz.com even though it only loads inside the Genesys Apps page.

Conversation Actions endpoints. If your organization connects Conversation Actions, your endpoint receives HTTPS deliveries from Mediabriz, and your system downloads delivered files from the Mediabriz API domain for your data region. Deliveries do not come from a fixed IP address, so verify the delivery signature rather than the source address.

All traffic is outbound HTTPS on port 443.

Disclaimers

The security measures described on this page represent CloudBriz's current practices and are subject to change. CloudBriz implements reasonable technical and organizational measures to protect the Service, but does not guarantee that the Service is free from vulnerabilities or that security incidents will not occur.

The Service depends on third-party platforms, including Genesys Cloud, cloud infrastructure providers, and web browsers. CloudBriz is not responsible for the security, availability, or performance of third-party platforms and does not guarantee their continued operation or compatibility.

Functionality and security may vary depending on the user's browser environment, version, configuration, and network conditions. CloudBriz does not guarantee compatibility with all browser versions or environments.

This page is provided for informational purposes only and does not constitute a warranty, guarantee, or contractual commitment. For binding terms, refer to the Terms of Use, EULA, Privacy Policy, and Data Processing Agreement.

For browser deployment, managed policy, and permission details, see the Enterprise Deployment Guide.

For questions about our security practices, visit our Support Center or contact us.