DATA SECURITY
Mining and survey data is commercially sensitive, and 'it's secure' is not an answer. This page states precisely which network requests STREAM makes, what each one contains, what is never transmitted, and where diagnostic files are written — so a security review can check the claims rather than take them on trust.
STREAM is a native Windows application. Loading a DEM, streaming it, rendering it on the GPU, computing volumes, running analyses, generating contours and writing exports all happen locally, using your own CPU, GPU, memory and disk.
There is no upload step, no processing queue and no per-project quota, because there is no server doing the work. That is also why performance depends on your hardware rather than on a subscription tier.
Elevation models, orthophotos, point clouds, CAD drawings, designs, measurements, volumes, reports and project files stay on the machine they were loaded on. None of them — and no part of them — is sent anywhere by STREAM.
File names, folder paths and project contents are not transmitted either. There is no analytics SDK, no usage tracking and no feature-usage reporting in the application.
Licence account actions you initiate — activation, sign-in, e-mail verification, password reset — send what that action needs, over HTTPS, to the licence server. Activation sends the e-mail address and password you typed.
Periodic licence validation sends the licence identifier, a device identifier, hardware signals, the signed licence token itself and a tamper flag. The device identifier is a one-way hash: 'fp-' followed by a truncated SHA-256 of the Windows MachineGuid. The hardware signals are likewise truncated, salted SHA-256 hashes of the SMBIOS UUID, the MachineGuid and the volume serial — the raw identifiers are not sent, and the hashes cannot be reversed into them.
An update check asks the release endpoint what the current version is. That is the complete list.
The licence client pins the server certificate. If a connection presents a certificate that does not match the pin, STREAM does not silently continue — the failure is reported distinctly from an ordinary offline condition, because a mismatched pin can mean an interception proxy rather than a dropped connection.
This matters on corporate networks that terminate TLS: the behaviour is deliberate and visible, not a silent downgrade.
If STREAM crashes, it writes a minidump to %LOCALAPPDATA%\Stream\crashdumps (or to the folder set in STREAM_CRASH_DIR). Writing it needs no administrator rights and no Windows Error Reporting registry changes.
That file is never uploaded. If you want us to look at a crash, you send the dump yourself — which also means you can inspect or refuse to send it. Deleting the folder is safe.
STREAM keeps a local diagnostic log. It is uploaded only if your licence token carries the diagnostic-collection flag, which is set for licences enrolled in the alpha diagnostic programme — for an ordinary licence the upload path does nothing at all.
Where it does apply, the log is minimised before it leaves: the Windows user name is masked out of file paths and the upload is capped to the most recent portion of the log.
An activated licence keeps working without a connection for the offline window carried in its token. Within that window STREAM validates the licence locally against the signed token, so a site network with no internet is a normal operating condition rather than a failure.
Once the window elapses, one successful online check is needed. Corporate proxy configurations are supported for that check.
STREAM reads and writes the formats your industry already exchanges: GeoTIFF, ESRI ASCII grids, LAS/LAZ, DXF, CSV, KMZ and PDF. Everything you produce can be taken out in an open format and opened elsewhere.
There is no proprietary archive you have to keep a subscription alive to read, and no export tier — the outputs are the outputs.
No. Elevation models, orthophotos, point clouds, designs, measurements and reports stay on the machine they were loaded on. Nothing about their contents, names or paths is transmitted.
Only licence traffic and an update check. Licence traffic contains the licence identifier, a one-way device hash, one-way hardware signal hashes, the signed licence token and a tamper flag — plus the e-mail address and password at the moment you sign in or activate. The update check asks what the current version is.
No. There is no analytics SDK and no feature-usage reporting in the application.
No. A minidump is written to %LOCALAPPDATA%\Stream\crashdumps and stays there. Sending it is your decision, and deleting the folder is safe.
Yes, within the offline window carried in your licence token. Validation happens locally against the signed token during that period; after it elapses, one successful online check is required. Corporate proxies are supported.
It is a truncated SHA-256 hash of the Windows MachineGuid, prefixed with 'fp-'. The hardware signals are salted, truncated hashes of the SMBIOS UUID, MachineGuid and volume serial. The raw values are not transmitted and the hashes cannot be reversed back into them.
Activation requires one online step, and the licence needs a periodic online check when its offline window elapses. Between those points STREAM operates without a connection. Contact us through the website to discuss a specific deployment.
Free beta for Windows x64. Works fully offline with GeoTIFF, LAS/LAZ and DXF.
Download STREAM free