Skip to content
SLX On Air

SLX On Air

Security

This page describes the security and privacy controls in SLX On Air as they work today, including their limits. It is written for people evaluating us — IT, security and procurement teams — so it states what we do rather than what we would like it to sound like. If something you need isn't here, ask and we'll answer directly.

Data protection

  • Encrypted in transit, everywhere. TLS 1.3 on the website and console, HTTP redirects to HTTPS, and our apps trust only the operating system's own root certificates — so interception tooling that works against a browser doesn't work against them.
  • Encrypted at rest by our managed cloud platforms. Application credentials are held in server configuration, never in source code.
  • Residency. Our primary database is hosted in Mumbai, India. Media storage, outbound email and payment processing are also handled within India. Some global services we rely on — sign-in, content screening, maps and analytics — are operated by Google and may process data outside India.
  • Retention is published and enforced in code. Crash logs 90 days. Device health tiered from 30 days of full detail to a year of daily summaries. Proof-of-Play raw events 90 days, summaries two years. Administrative audit records two years. Invoices per statutory requirement.
  • Deletion is a workflow, not a support ticket. Invoices and Proof-of-Play reports are delivered through expiring, access-checked links.
  • Rate limiting on public API endpoints, returning 429 above threshold, and inbound webhooks are signature-verified with HMAC-SHA256. Served with HSTS, a strict framing policy and browser-enforced hardening headers; preload is submitted.
  • We never touch your card details. Payments go to our PCI-DSS-compliant gateway; we store an order reference and an amount.
  • A published sub-processor list, what each receives and why — the timestamping authority receives only a cryptographic hash. Vulnerability disclosure at /.well-known/security.txt, RFC 9116, with a monitored mailbox.

Limits

  • Content posted to a board is public by design, because a board is a public screen. It is not private or access-controlled.
  • Our support staff can view customer content through an internal console, under named controls, and can capture a screenshot of a screen for diagnostics on request.

Access & identity

  • No passwords. Sign-in is Google, Apple, or a one-time emailed link. Nothing is created, stored or transmitted, and we hold no password database.
  • Short-lived tokens that renew silently. Signing out ends the session on the device and on our servers — the app is wiped to a fresh-install state and the credential is invalidated immediately rather than left to expire.
  • Session credentials are held in the phone's secure hardware store and are never copied into cloud backups.
  • Organisation roles — owner, admin, billing — govern the console. Board posting permissions are a separate content-moderation model.
  • The server is the authority. Client-side checks are presentation only. Cross-site request forgery is structurally impossible: authorisation travels in an explicit header, never an ambient cookie.
  • Administrative actions are audit-logged — who, what, when, to what, and whether it succeeded — for two years. If your organisation enforces two-step verification on Google or Apple, it applies to your console too.

Limits

  • No SSO/SAML or enforced MFA today — available for enterprise deployments on request.
  • No self-service session revocation, no customer-visible audit trail, and no forced session expiry.

The Smart Box on your network

  • Outbound-only. No inbound ports are open in normal operation. The box opens no listening sockets; every connection is initiated by the box. No VPN, no port forwarding, no inbound firewall rule.
  • It never scans or reaches anything else on your network — no mDNS/Bonjour, no SSDP/UPnP, no subnet sweeping, no SMB or printer discovery.
  • It runs on an isolated guest VLAN with no route to internal systems, and needs no static IP or DHCP reservation. Wired Ethernet is the recommended enterprise installation.
  • Your Wi-Fi password never reaches our servers. It goes from your phone to the box over a direct short-range Bluetooth link — never transmitted to us, never written to our app's storage, never logged.
  • It's an appliance, not a computer. No home button, no menu, no app drawer, no way to close the app from the screen, and USB debugging disabled on production devices. Remote support is five fixed actions the box enforces from an allowlist — no remote shell, no arbitrary command execution.
  • The screen keeps playing when the internet doesn't. Take-down is immediate: remove something in the console and it's off the screen within minutes. Remote maintenance access is off by default, must be authorised, and expires automatically.

Software updates

  • Application updates are signed and signature-verified by the device before installation. The operating system refuses any update not signed with our key, and the signing key never travels with an update.
  • This is what stops a malicious update server. Even with full control of our update servers, an attacker could not install substituted software.
  • A hostile network can delay updates, not change them. A redirected or intercepted connection fails validation and is dropped. There is no fallback to an unverified path.
  • Rollouts are staged and can be halted at any point. A failed update restores the previous version automatically and blocks the bad one from retrying; power loss mid-update leaves the box on the version it had.
  • It repairs itself, and security fixes typically reach the fleet within 24 hours without a site visit. Update reports contain device identity, versions and outcomes — never your content.

Limits

  • Scoped to SLX On Air application software — operating-system patching is the hardware vendor's responsibility.
  • Customers cannot defer, schedule or approve updates.

Proof of Play

  • Available on Pro boards, enabled per board.
  • Tamper-evident records. Each play is recorded in a chain where every entry mathematically depends on the one before it, so nothing can be inserted, deleted, reordered or edited afterwards without the chain visibly breaking — including by us.
  • Signed on the device with an elliptic-curve key generated inside the box's secure key store, which cannot be exported.
  • Timestamped by two independent authorities — freetsa.org and DigiCert — and the timestamps are published. Anyone can download the raw RFC-3161 tokens and verify them without trusting us, at our public verification portal, with no account.
  • Where the panel reports its state, we can tell whether the TV was actually receiving a signal over HDMI. Screen-time we can vouch for is shown as verified; time we can't is disclosed separately.

Limits

  • It proves the player rendered the content — not that a person saw it. An unsensed screen in an empty room produces identical records.
  • Some TVs keep their HDMI receiver powered in standby and never report a change; those are graded panel unknown rather than counted as verified.
  • It is not audience measurement — no impressions, no dwell time, no demographics.
  • Integrity is guaranteed from the moment the box recorded the event onward. A re-provisioned box restarts its chain — expected and visible, not a break.

Privacy & tracking

  • Nothing is tracked on this website until you agree. Analytics and advertising storage default to denied before any tag loads, with per-category choice you can withdraw later — verifiable from any browser's network tab.
  • No advertising SDK, no advertising identifier, no data sold to brokers — which is why the apps never show the "allow tracking?" prompt.
  • The Smart Box reports device telemetry only — its own address, board, app version, uptime, network type and signal, temperature, and which content played when. It ships with no camera or microphone.
  • The apps never ask for your microphone, your contacts, or background location. On iOS, location is a single approximate reading — when-in-use, about 100 m, stopping after the first fix. On Android it is requested in context rather than at launch, the app works without it, and Bluetooth scanning is declared neverForLocation.
  • Analytics and crash reporting are Firebase only, carrying technical tags and our own user id — no post text, no photos, no message content — and can be switched off in the app. We never access your photo library: you choose photos in your phone's own picker.
  • Privacy built around India's DPDP Act, with a documented data inventory, purpose record and retention schedule. Minimum age is 13.

For enterprise & healthcare

  • We are public-display signage, not a healthcare data system. No clinical integration, no HL7/FHIR, no patient identifiers anywhere in our data model.
  • All content is customer-authored and intended for public display, so patient data must never be posted to a board — the same rule that applies to the lobby noticeboard we replace.
  • Wired Ethernet is the recommended installation. Plug the box in and setup is skipped entirely.
  • Screens get security patches automatically, with no IT ticket and no site visit, typically within 24 hours.
  • Our support staff cannot sign in as you — there is no impersonation feature — but they can act on your account, and every action they take is recorded with two-year retention.

Limits

  • No external penetration test has been carried out.
  • No certificate pinning, deliberately — it is incompatible with the TLS inspection many enterprise networks run.
  • We publish no SLA or uptime figure.

Security pack

A fuller written answer for a security review — controls, sub-processors, retention, and the things we deliberately don’t do, with the reasoning. Sent to your inbox.

Request the security pack