Security
How we protect your account, your content and the screens you run on DigiSignWall.
Last updated:
Encryption
All traffic between browsers, players and our services uses HTTPS (TLS). Our website sends HSTS headers, so browsers refuse to connect over plain HTTP. Passwords are stored only as salted bcrypt hashes. Email verification and password-reset codes are single-use, limited in the number of attempts, and expire after a short time.
Sign-in and access control
Accounts use role-based permissions. For example, an operator who only schedules content cannot change billing or invite users. Sign-in endpoints are rate-limited, and new accounts must confirm their email address before they can be used. Sessions use short-lived access tokens, which are invalidated when a password is reset.
Custom plans can add single sign-on (SSO) and IP allowlisting for the admin console. Every administrative action in an account is recorded in an audit log that account admins can review.
Tenant isolation
DigiSignWall is multi-tenant. Every request is scoped to a tenant identifier, and media is stored under per-tenant paths, so one customer’s content cannot be reached from another account.
Player security
Players are paired with a one-time pairing code and then hold a device-scoped credential instead of user credentials, so a stolen screen cannot be used to sign in to the admin console. Players cache the latest schedule and media on the device and keep playing through network outages and after a restart. When you remove a screen from your account, it stops receiving content.
Infrastructure, backups and availability
The Service runs on cloud servers with a separate MySQL database and Redis. Access to production systems is limited to authorised staff. We take automated backups on a rolling 14-day cycle, and services are monitored with automated health checks.
We aim for high availability, but availability is a target, not a contractual commitment. A service level agreement (SLA) applies only where it is written into a signed Custom agreement. See our Terms of Service.
AI assistant and third parties
The optional AI assistant sends only the instructions and material you include in a request to third-party AI model providers, to generate the layout you asked for. Payments are processed by Stripe, and card details never touch our servers. Our Privacy Policy lists the categories of provider we use.
Responsible disclosure
If you believe you have found a vulnerability, email emailus@digisignwall.com with the subject “Security report” and steps to reproduce it. We will acknowledge your report within two business days and keep you updated until it is resolved. Please give us a reasonable time to fix the issue before you disclose it publicly. While testing, do not access or change other customers’ data, degrade the Service, run high-volume automated scans against production, or use social engineering.
We will not take legal action against researchers who follow this policy in good faith.
Reporting an incident
If you suspect that your account has been compromised, reset your password right away and email emailus@digisignwall.com. If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires.