Video Conferencing Software Development: 2026 Build Guide

Why Fora Soft wrote this guide

Fora Soft has built video and real-time communication software since 2005 — 250+ shipped products, 50 in-house engineers, and a decade-plus of WebRTC in production. Video conferencing software development is our core practice, not a side line, so this guide is written from calls we have shipped and outages we have debugged.

Three of those builds shape the advice here. BrainCert is the world’s first WebRTC + HTML5 virtual classroom: 500M+ real-time classroom minutes across 10 datacenters, 99.995% uptime, 100k+ customers, and 4 Brandon Hall Awards (including one for conferencing technology). We built it from the architecture up. ProVideoMeeting pairs a WebRTC SFU with FreeSWITCH for SIP dial-in and adds in-call e-signature. CirrusMED is a HIPAA telehealth platform for a Nevada practice, now serving patients across 48+ US states.

If you are new to how video is captured, encoded and moved, our primer on digital video foundations is a gentler on-ramp. This guide assumes you want the build decisions: topology, vendors, cost, scale and compliance, with the numbers to defend each one.

What “scalable” actually means here

“Scalable” in video is three independent numbers, and conflating them is the first budgeting mistake. A one-to-one telehealth visit and a 5,000-seat webinar both count as “video conferencing,” but they stress completely different parts of the stack.

1. Participants in a single call. Four people fit a peer-to-peer call. A hundred need an SFU. Ten thousand watching one speaker is really a broadcast, and belongs on HLS or LL-HLS, not a mesh of WebRTC peers.

2. Concurrent calls across the system. Ten thousand simultaneous 8-person calls is 80,000 live media streams. That is a capacity-planning problem — SFU instances, memory per stream, connection pools — separate from any single call’s size.

3. Geographic spread. A user in Mumbai hitting an SFU in Virginia sees 250–300ms of round-trip before you add codec and jitter delay. Regional SFUs and geo-routing are what keep latency under the ~150ms where conversation still feels live.

WebRTC: the building blocks you cannot skip

WebRTC gives you a media engine: capture, encode, encrypt and transport audio and video peer-to-peer. What it does not give you is servers. You still build or rent the signaling, NAT traversal and media-routing tiers around it. The W3C WebRTC specification defines the browser API; everything else is your architecture.

Figure 1. The moving parts of a video conferencing platform. Signaling sets up the call; the SFU moves the media; TURN, recording and AI hang off it.

The media pipeline

Capture from the device, encode with a negotiated codec, packetize into RTP, encrypt with DTLS-SRTP, and send over UDP. Target end-to-end latency is under 200ms; mobile networks add 50–100ms of jitter-buffer delay on top. Getting this pipeline right is most of what separates a call that feels present from one that feels like a walkie-talkie.

Signaling

Signaling is the out-of-band channel that sets up a call: it exchanges SDP offer/answer, relays ICE candidates and tracks call state. WebRTC deliberately does not specify it, so you own it — usually a WebSocket service in Node or Go. Keep media off this path; its job is setup and control, not carrying frames.

STUN, TURN and ICE

STUN lets a client discover its public address behind NAT. TURN relays media when a direct path fails. ICE tries them in order: direct, then STUN-assisted, then TURN. Plan for roughly 20–30% of sessions to need TURN. Corporate firewalls and symmetric NAT make it non-optional, not a fallback you can skip.

Codecs in 2026

The mandatory-to-implement WebRTC video codecs are still VP8 and H.264 (RFC 7742), so offer both for compatibility. Safari and iOS lean on hardware H.264. For quality-per-bit, VP9 and AV1 with SVC (scalable video coding) plus simulcast are the modern lever: the SFU forwards the right layer to each viewer without transcoding. AV1 has been real-time-capable in Chrome since 2021, but hardware AV1 encode is still rare, so treat it as an enhancement over a VP8/H.264 baseline, not a replacement.

P2P, mesh, SFU, MCU: which topology

Your topology decides your ceiling on participants, your bandwidth bill and who pays the CPU. Four patterns cover almost every product; most real platforms settle on an SFU.

Figure 2. How streams flow in each topology for a four-person call. P2P and mesh push cost onto every peer; the SFU centralizes it cheaply; the MCU mixes at a CPU premium.

Peer-to-peer (P2P)

One media path between two clients. Zero server cost, sub-50ms latency, full quality. It does not go past a handful of people because each peer uploads a separate stream to every other peer.

Mesh

Every participant connects to every other participant. Latency stays low, but upload bandwidth grows with each person added, so it falls over around 6–8 on typical networks.

SFU (Selective Forwarding Unit)

The SFU receives each participant’s stream once and forwards it to the others without decoding or mixing. Bandwidth per user stays flat, CPU stays cheap, and it carries hundreds per node. This is what Google Meet, Jitsi and most modern platforms run, and it is where a serious video conferencing build almost always lands.

MCU (Multipoint Control Unit)

The MCU decodes every stream, composites them into one grid and sends a single stream back to each client. Client bandwidth is minimal, but re-encoding is expensive and adds latency, so it tops out around 20–50 participants.

Architecture at a glance

Read the server-cost column as marginal cost only. An SFU at ~$0.004/min looks close to CPaaS on paper, but you also carry the fixed ops of running it — which is exactly the trade-off the cost model below makes concrete.

CPaaS vs custom WebRTC

The real first decision is not P2P versus SFU — it is rent versus own. A CPaaS (communications platform as a service) hands you a global SFU, SDKs and compliance templates for a per-minute fee. A custom WebRTC build gives you full control of the stack and a lower marginal cost, at the price of an 18–24 month engineering and ops commitment.

Vendor status has changed — verify before you design around it. Twilio Video is alive: its announced shutdown was reversed in 2024 and it remains a standalone product. Dyte’s SDKs moved to maintenance-only after the team joined Cloudflare, whose RealtimeKit is the migration path. Amazon’s Chime consumer app is retiring in February 2026, but the Chime SDK is a separate product that continues. If you are on Twilio and weighing a move anyway, our Twilio Video migration guide and Daily alternatives walk the options.

The hybrid that often wins

Use a CPaaS for live calls while you are small and unpredictable, and move recording, transcription and any heavy compliance to your own infrastructure. It keeps time-to-market short without handing a vendor your archived media — a common shape for e-learning, telehealth and legal products.

2026 CPaaS pricing, compared

What does CPaaS actually cost in 2026? Group calls bill every participant every minute, so a 10-person hour is 600 participant-minutes, not 60 — the single most common estimate error. Published standard rates, per 1,000 HD-video participant-minutes: Agora and 100ms around $3.99–$4.00; Zoom Video SDK $3.50; Amazon Chime SDK $1.70; Daily around $1.50 at volume; LiveKit Cloud about $0.40 but with bandwidth billed separately at $0.12/GB.

Figure 3. Published 2026 CPaaS rates per 1,000 HD participant-minutes. LiveKit’s low per-minute rate is offset by separate bandwidth billing.

Two caveats before you rank on price alone. LiveKit’s headline rate excludes egress, so model your GB-per-minute or the $0.40 is misleading. And free tiers matter early: Agora, Zoom SDK and Daily each include ~10,000 free minutes a month, which can cover an MVP outright. For a deeper head-to-head, see our LiveKit vs Agora cost analysis.

Open-source SFUs, compared

If you self-host, four SFUs are worth serious evaluation in 2026, and one popular name is now a trap. The short version: LiveKit for speed to production, mediasoup for fine-grained control, Janus for a modular C core, Pion when you want pure Go.

LiveKit (Apache-2.0, built on Pion) is the fastest route to production and adds an Agents framework for wiring AI into calls — see our LiveKit AI agents guide. mediasoup v3 keeps a C++ media worker with a Node or Rust API and gives you the tightest control over simulcast and bitrate. Janus is a maintained, plugin-based C server. The one to avoid for new builds is ion-sfu: it is effectively dormant, with no recent releases and a README that points people to LiveKit instead.

Signaling servers: the call brain

The signaling server is the brain of a call even though it never touches a video frame. It creates rooms and assigns an SFU region, brokers the SDP offer/answer, forwards ICE candidates, enforces participant limits and bandwidth policy, and authenticates every join with short-lived JWTs. Build it on WebSocket for sub-200ms round-trips, cache SFU endpoints in Redis rather than hitting DNS per call, and run at least three instances across availability zones. If signaling dies, every call drops with it.

TURN and STUN: NAT traversal

Most corporate networks block direct peer connections, so your signaling has to advertise STUN and TURN servers. coturn is the de-facto open-source choice and is actively maintained. Budget roughly 3–5 TURN servers per region (2 vCPU / 4 GB each is a reasonable unit) plus egress at $0.30–0.50 per GB, and open UDP/TCP 3478 and TLS 5349.

The failure mode to instrument for is a client stuck in ICE “checking” — it has exhausted every candidate pair. Log each failed pair and alert on it; the usual causes are a dead TURN server, a firewall blocking UDP, or missing TURN credentials in the signaling response.

Recording and AI transcription

Recording is a separate pipeline; never bolt it onto the SFU’s hot path. Fan RTP out to a dedicated recorder (FFmpeg or a purpose-built worker), write to fast local disk, and upload to S3 or GCS asynchronously with lifecycle policies (for example, auto-delete at 30 days for compliance). Scale recorders independently on queue depth, not by adding load to media nodes.

For transcription in 2026, the strongest open model is OpenAI’s Whisper large-v3; the large-v3-turbo variant trades a little accuracy for near-real-time speed. Whisper has no built-in speaker labels, so pair it with WhisperX and pyannote for diarization. If you would rather call an API, Google Speech-to-Text runs about $0.016/min (dropping toward $0.004 at volume, with 60 free minutes a month) and Azure real-time is roughly $1/hour. Adding live captions or an in-call assistant is its own architecture — our guide to video AI agents covers the latency budget.

Security and compliance

WebRTC encrypts media by default with DTLS-SRTP, and the DTLS fingerprint is exchanged over signaling to block man-in-the-middle attacks — verify it. For zero-trust media where even your SFU should not see plaintext, add end-to-end encryption with Insertable Streams (SFrame). Everything else is discipline you design in, not features you add later:

HIPAA. Audit trails (who, when, duration, size), encrypted recordings, consent logging, US data residency, a signed BAA with every processor, and annual penetration testing. This is table stakes for the telehealth work we do on platforms like CirrusMED.

GDPR. Deletion on request, EU data residency, explicit consent management, a DPA with every processor, and a privacy impact assessment before launch.

SOC 2 Type II. Change control, incident response, access logging and vendor assessment, audited over a period rather than a point in time. For the media-specific side — DRM, watermarking, token-gated access — see our write-up on video security features.

Build vs buy: a cost model that breaks even

Here is the arithmetic that should drive the decision, with the numbers shown so you can swap in your own. Take a blended CPaaS rate of $0.004 per participant-minute. A 10-person, 60-minute meeting is 10 × 60 = 600 participant-minutes, so it costs 600 × $0.004 = $2.40. Run 1,000 of those a month and CPaaS bills about 600,000 × $0.004 = $2,400.

Figure 4. Where a self-hosted SFU overtakes CPaaS. Below the crossover, rent; above it, owning the stack is cheaper per month.

Now the self-hosted side. Assume ~$8,000/month of fixed cost (a 3-region SFU fleet, TURN, monitoring and an on-call ops share) plus a marginal $0.0008 per participant-minute for servers and egress. Set the two equal to find the break-even: $8,000 = minutes × ($0.004 − $0.0008), so minutes = $8,000 / $0.0032 ≈ 2.5M participant-minutes a month. Below that, CPaaS is cheaper; above it, owning the stack wins, and the gap widens fast at scale.

Two honest caveats. That $8k marginal model excludes the up-front 18–24 month build; a custom SFU pays back on ongoing cost, not on day one. And these are planning figures — we will not quote your build blind, because the real number depends on features, clients and compliance. Where we do move faster and cheaper than the typical shop is delivery: our Agent Engineering approach compresses the schedule, which is exactly what shifts a build-vs-buy line in your favor. For a granular breakdown, our video conferencing app cost guide goes feature by feature.

Scaling to 100k concurrent

You scale video by adding nodes, not by buying a bigger one. A well-tuned mediasoup or LiveKit node handles roughly 500–800 video participants before CPU on packet forwarding becomes the ceiling. Past that, you shard across nodes and, for global reach, cascade SFUs across regions so users connect to the nearest one and nodes relay only the shared streams between them.

Figure 5. From a single node to a global cascade. One SFU tops out near 500–800 participants; regional nodes relay shared streams and route users to the nearest edge.

The reference platforms are instructive when you cite them accurately. Google Meet runs on WebRTC with an SFU and standard codecs (VP8, VP9, AV1). Zoom historically avoided browser WebRTC, shipping its own codecs through WebAssembly for years; its newer Video SDK added a WebRTC path with a WASM fallback. The lesson is not to copy either wholesale but to size nodes, route by geography, and fail over cleanly.

Deployment checklist

Multi-region SFUs. Independent clusters in us-east, us-west, eu and ap-southeast, with geo-routing to the nearest node under a ~100ms RTT target. Autoscale on real signals. Spawn a node at 80% CPU or memory, drain after ~15 minutes idle, and health-check every 10 seconds. Separate the recording tier so it scales on its own. Instrument everything — latency, jitter, packet loss and ICE setup time in Prometheus and Grafana, with alerts above 5% error rate. Video platforms fail quietly; a 2% jitter creep degrades calls before support hears about it.

Inside BrainCert: 500M+ classroom minutes

The situation. BrainCert set out to put live, HD virtual classrooms in the browser before that was a solved problem, competing with VC-backed incumbents on a lean team. Early small-group calls ran fine on P2P, but quality was unpredictable the moment a class grew.

The plan. We moved the media layer onto self-hosted SFUs, then expanded region by region, and split recording into its own pipeline writing to object storage with compliance-driven lifecycle rules. Codec negotiation, jitter buffers and reconnection logic were tuned against real classroom networks, not lab conditions.

The result. BrainCert now delivers 500M+ real-time classroom minutes across 10 datacenters at 99.995% uptime, serves 100k+ customers, and has won 4 Brandon Hall Awards including one for conferencing technology. BrainCert’s CEO, Yasin Rahim, put it plainly: “From technical architecture to programming, they do it all for us.” Want a similar assessment of your video stack? Book a 30-minute review and we will walk your architecture with you.

A decision framework in five questions

1. How many people per call? Under 4, P2P is fine. Tens to hundreds, use an SFU. Thousands watching one speaker, that is a broadcast — use HLS, not a conference.

2. How much volume, monthly? Below ~2.5M participant-minutes, CPaaS almost always wins on total cost. Well above it, a self-hosted SFU starts paying for itself.

3. Are you regulated? HIPAA, GDPR or finance pushes you toward controlling recording and residency yourself, which favors a custom or hybrid stack over a pure black-box vendor.

4. How fast must you launch? Under six months with a small team, start on CPaaS. You can migrate the media layer later once the product and the numbers are proven.

5. How custom is the experience? Off-the-shelf UX and flows, CPaaS ships faster. Deep integration with your product, recording workflows or AI features, a custom build earns its keep. Still unsure? That is exactly the call we take on a 30-minute scoping call.

Pitfalls that sink video projects

1. Choosing P2P for group calls. It collapses past ~4 people. If you plan to scale beyond a handful, start on an SFU rather than rewriting the media layer under load later.

2. Treating TURN as optional. Roughly 20–30% of sessions need it. Under-provisioning TURN shows up as calls that connect for some users and silently fail for others behind corporate firewalls.

3. Recording on the SFU. Writing media straight from the forwarding node makes disk throughput your scaling ceiling. Fan out to a separate recorder tier from the start.

4. Ignoring mobile networks. Mobile brings 20–50ms of jitter and half the bitrate of desktop. Tune codec and bitrate per device class instead of shipping one profile.

5. Single-instance signaling. One signaling node is a single point of total failure — when it dies, every call drops. Run three or more across zones with failover.

6. No adaptive bitrate. A fixed 2 Mbps stream survives office WiFi and dies on 4G. Use simulcast or SVC so each viewer gets a layer their network can carry.

7. Flying blind. “Latency went up” with no instrumentation is unsolvable. Capture ICE setup time, codec, packet loss and jitter-buffer depth per session.

8. No reconnection logic. A five-second network blip should not end a call. Implement reconnection with exponential backoff so a brief drop recovers instead of showing a frozen frame.

When NOT to build your own

The honest answer is that plenty of teams should not build a custom video stack, and saying so has saved our clients real money. Reach for CPaaS, and revisit later, if any of these hold:

• You have under six months to launch and fewer than ten engineers.
• Your ops and infrastructure budget is under ~$100k a year.
• Demand is unpredictable — you might need 1,000 users or 1,000,000 in six months.
• You do not have 24/7 on-call coverage for media infrastructure.
• You must launch in several countries at once without a global ops team.

None of that is permanent. The common path is CPaaS first, then a custom or hybrid SFU once volume crosses the break-even and the product is proven. Building too early is how teams spend a year on infrastructure instead of a product.

FAQ

What is video conferencing software development?

It is the work of building real-time audio/video calling into a product: the WebRTC client, a signaling server, media routing (usually an SFU), NAT traversal via STUN/TURN, and the recording, security and scaling tiers around them. It spans choosing an architecture, integrating or self-hosting media servers, and meeting compliance for your industry.

How much does it cost to build a video conferencing app?

It depends on scope, but the operating math is clear: CPaaS runs roughly $1.50–$4.00 per 1,000 HD participant-minutes, while a self-hosted SFU trades ~$8,000/month of fixed ops for a far lower per-minute rate and breaks even near 2.5M participant-minutes a month. The up-front build is separate; our cost guide breaks it down feature by feature.

Does WebRTC need a signaling server?

Yes. WebRTC carries media but not the setup handshake, so you always need an out-of-band signaling channel to exchange SDP and ICE candidates. Even a 1:1 call needs a lightweight server to broker that first connection.

SFU or MCU: which should you use?

An SFU for almost all modern group video: it forwards streams cheaply, supports adaptive quality, and scales to hundreds per node. Choose an MCU only when clients are bandwidth-limited or legacy, or when a regulated setup needs one composited recording.

Is Twilio Video being shut down?

No. Twilio announced an end-of-life in 2024 and then reversed it; Twilio Video remains a standalone product. Separately, Dyte’s SDKs went maintenance-only after the team joined Cloudflare, and Amazon’s Chime consumer app retires in 2026 while the Chime SDK continues.

How many participants can one SFU handle?

A well-tuned mediasoup or LiveKit node handles roughly 500–800 video participants before packet-forwarding CPU becomes the limit. Beyond that you shard across nodes and cascade SFUs across regions for global scale.

Which video codec should you use in 2026?

Offer VP8 and H.264 as the mandatory baseline for compatibility (Safari and iOS prefer hardware H.264). Layer VP9 or AV1 with SVC plus simulcast for quality-per-bit, treating AV1 as an enhancement since hardware encode is still uncommon.

How do you make video calls HIPAA compliant?

Encrypt media (DTLS-SRTP, and end-to-end with Insertable Streams where needed), keep audit trails and consent logs, store recordings encrypted with US data residency, sign a BAA with every processor, and pen-test annually. Controlling your own recording and storage is why regulated products often go custom or hybrid rather than pure CPaaS.

What to read next

Ready to build the right way?

Video conferencing software development comes down to a handful of decisions made in order: pick the topology for your call size, rent CPaaS until volume crosses the ~2.5M participant-minute break-even, self-host an SFU when it does, and treat encryption and compliance as build inputs rather than afterthoughts. Get those right and the rest is tuning.

The teams that win do not over-build early or under-instrument late. Start where your numbers put you, measure everything, and move the media layer when the cost model, not the hype, says to. That is the same playbook we have run from BrainCert’s 500M minutes down to a single-clinic telehealth launch.