Application Security & Protocols

Your passwords are stored in our database and encrypted using the top-of-the-line Argon2 password hashing algorithm. This way, your passwords are not known to our staff and will not be compromised in the unlikely event of a data breach. Your login sessions use Secure HTTPS-only cookies to eliminate the risk of eavesdroppers stealing them by intercepting your connections.

When you register (or change your password), we go the extra mile and check your password against a public database of leaked passwords to make sure you’re not using an insecure password. Your password does not leave our servers during the check; we use the k-anonymity protocol to check the password with the trusted service HaveIBeenPwned.

Our web chat is run by Crisp, another security-conscious company. You can find their practices described in detail.

Additionally:

• All communication between your devices or browser and our servers is protected using SSL and DNSSEC.
• We back up your data multiple times a day.
• We use Cloudflare to detect and mitigate hacker attacks.
• We support Two-Factor Authentication.
• All the communication between our servers is encrypted and done over private networks.
• Our web portal uses CSP rules to prevent XSS attacks.
• Our API allows only CORS requests from our domain websites.

Read more:

• https://en.wikipedia.org/wiki/Argon2
• https://www.password-hashing.net/
• https://docs.crisp.chat/guides/others/security-practices/
• https://en.wikipedia.org/wiki/K-anonymity
• https://haveibeenpwned.com/Passwords

All connections to our servers are HTTPS, which means that the traffic is encrypted, including WebSocket connections. We have disabled SSLv3 and use TLS exclusively.

The Internet traffic is routed through the Cloudflare network, which protects our servers against Denial Of Service (DoS) and brute force attacks.

Read more:

• https://www.cloudflare.com/cybersecurity/
• https://disablessl3.com/

Your files are stored on our servers in Europe or in the USA, depending on your location. We can’t make the files private, because the players need to be able to download them from the internet, but we generate a unique ID for each file, so the URL is virtually impossible to guess. For example, this is the URL of an uploaded file:

https://eu-storage.playsignage.com/aac73f17-380c-40c2-a869-e23b261bcd62/05e2b56f-13b3-44c2-b344-7690def51b67/05e2b56f-13b3-44c2-b344-7690def51b67.png

An attacker has a better chance of guessing your password! (so make sure it’s secure)

Your uploaded files are also backed up in the same region (Europe or the USA, depending on your location), as a failover in case there is a disruption to the main file storage.

For files that require conversion (any video file except .mp4, and the Apple office formats .key, .numbers and .pages), we use a conversion service CloudConvert. They outline the file handling in their privacy policy:

In the course of providing the service your files are transferred to and temporary stored on servers of CloudConvert. We do not read, look into or mine any data from your files or its metadata. We do not make any copies of it. All file processing is done by machine and there is no human interaction with your files. Your files are deleted immediately and irreversible from our servers when you click the “×” icon (on the right beside the Download button). This will happen automatically at the latest after 24 hours.

If your files cannot be stored on the public web due to company policy or any other reason, you can also reference files from a private file server. Read more about private files.

When a player is linked to a user account, the server generates a unique secret token that is sent to the player once. Every subsequent request made by the player to our servers requires the token to be present in order to prevent malicious attackers from impersonating the player. The weakest link is the physical security of the player, so make sure it’s out of sight and, if possible, out of reach!

Read more:

• https://www.jwt.io/introduction#what-is-json-web-token
• https://en.wikipedia.org/wiki/JSON_Web_Token

We use Stripe as our payment gateway, and they take care of storing your information securely. Stripe is a PCI Data Security Standard-certified company. When you link a credit card with your account, your credit card numbers are sent to Stripe servers directly from your browser; our system does not store or process your credit card information.

Read more:

• https://docs.stripe.com/security

Your team’s screens, playlists and files are stored in the USA or in Europe. If the first user on the team signs up from a US-based IP address, that data is stored on US servers; otherwise it is stored in Europe.

Your account and login data (name, e-mail, password hash and security audit log) is stored and processed by Cloudflare, which runs our login service. See Where is it stored? in our Privacy Policy.

While our system does not currently hold formal security certifications, it has undergone and completed a comprehensive Tier 2 Cloud Application Security Assessment (CASA), which included a full codebase review by an external assessor.

We also follow secure coding practices and adhere to OWASP Top 10 principles to continuously improve our security posture.

Upon every successful login, we use the k-anonymity protocol to securely check your password against an online database of compromised passwords – Pwned Passwords. Our system will notify you if your password has been a part of one or more data breaches in the past and ask you to change it to keep your account secure.

IMPORTANT: all the passwords in our database are encrypted (hashed) using a top-of-the-line Argon2 algorithm, and nobody but you knows what your actual password is.

If you created your account with your Facebook account, you should keep using it. But if you’ve forgotten and create a new login with, for example, a username and password, we link both logins to the same account. This way it doesn’t matter whether you log in with Facebook or a username and password, because it’s the same account you’re accessing.

If you can’t log in, please use “Forgot password”. If you have questions, contact us via our live chat.

There are a few domains working together when accessing Play Digital Signage. To name a few:

• login.playsignage.com for authentication
• my.playsignage.com for accessing the dashboard
• us-api.playsignage.com and assets.us.playsignage.com for backend API
• playsigna.ge for previewing content
• release.playsignage.com for downloading/updating our application

The optimal solution is to whitelist all subdomains of *.playsignage.com.

If you believe you have found a security vulnerability in our software or would like to conduct penetration testing, please read our Vulnerability Disclosure Program to find out how to report it to our team.