The short answers to the questions security reviews ask most. Each topic lists what is in place today and, just as clearly, what is not available yet.
Encryption
In place today
In transit: every connection between TVs, browsers and DisplayMe uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP.
At rest: the database (Cloudflare D1) and file storage (Cloudflare R2) holding your accounts and uploaded images/videos are encrypted at rest by Cloudflare.
Passwords are one-way hashed (salted PBKDF2-SHA-256, 100,000 iterations). They are never stored or sent back in plain text.
Two-step secrets (authenticator app seeds) are additionally encrypted with AES-GCM before they are saved. Backup codes and sign-in codes are stored only as hashes.
Backups: point-in-time recovery of the database is provided by the Cloudflare platform and is access-restricted to our deployment account.
Not available yet
Customer-managed encryption keys (bring your own key)
Per-customer encryption of uploaded files on top of the platform encryption
Authentication & access
In place today
Sign in with email + password, a one-time email code, Sign in with Google, or Telegram.
2-step verification with any authenticator app, plus backup codes. Owners can require 2-step for every Admin and Owner in the organization.
Brute-force protection: rate limits on sign-in and on code requests, and a code is cancelled after 5 wrong tries.
Sessions can be listed and signed out from the account menu.
Invitations are single-use and expire after 7 days.
Not available yet
SAML 2.0 single sign-on (Entra ID, Okta, OneLogin) and enforced SSO
Our own workforce SSO policy is not independently audited
Access control
In place today
Four roles — Viewer, Editor, Admin, Owner — and Owners can adjust what each role may do.
Per-store limits: a person can be limited to certain stores; they cannot see or change other stores, screens or their playlists.
Every organization’s data is separated by organization ID in each database query.
An audit log records team changes and content and settings changes, with who did it and when.
Only Admins and Owners can change settings, TV models, alerts and team members.
Not available yet
Fine-grained custom roles beyond the four built-in ones
Automatic access reviews or SCIM user provisioning
Network security
In place today
The TV player is a web page that only makes outbound HTTPS calls. It opens no port, so nothing on the internet can connect into a store.
Runs behind the Cloudflare network, which provides DDoS protection and global edge TLS.
Browser protections on every page: Content-Security-Policy, nosniff, frame protection and same-origin referrer policy. API responses are locked down so they cannot be framed or run as pages.
TVs are paired with a short-lived code/QR and an optional pairing PIN; admins can remove a device at any time.
A deliberately small code base: three third-party packages (image decoding, QR reading, QR creation). Fewer dependencies mean less to patch.
Dependency alerts are on in our code repository, and the platform (Cloudflare) patches the servers, so there is no operating system for us to keep up to date.
Not available yet
Independent third-party penetration test
Automated vulnerability scanning in a build pipeline
Incident response
In place today
Platform logs are enabled so activity can be investigated.
If personal data is affected, we tell affected customers without undue delay, aiming for within 72 hours of confirming it.
Offline-screen alerts (email, Telegram, sound) tell you quickly when a store screen stops responding.
Not available yet
24/7 security operations centre
A published, tested incident-response plan with fixed response-time targets
AI usage & data handling
In place today
DisplayMe does not use artificial intelligence on your content, and your uploads, playlists, store data and account data are not sent to any AI provider.
Your content is never used to train any model.
No advertising or analytics trackers; no selling of data. See Subprocessors for the full list of vendors.
Secure development lifecycle
In place today
Source code is kept in a private repository; every release is a tracked, numbered change with a written change note.
Each release is tested before it ships: sign-in, roles and store limits, uploads, TV playback and alerts are exercised in a real browser against a test copy of the system.
Secrets (API keys, tokens) are kept in the platform’s secret store, never in the code, and are rotated if they are ever exposed.
Deploys are automatic from the repository to Cloudflare; a failed build does not replace the running version.
Not available yet
Mandatory independent code review on every change (today the developer reviews and tests each release)
Formal certifications such as SOC 2 or ISO 27001
Honest status: DisplayMe does not currently hold a SOC 2 or ISO 27001 certification, and none of the controls above has been audited by an outside firm. They are real controls we run today. We will show a certification here only after we have earned it.