Security and governance
Digital signage security and compliance your IT team can check.
Screens sit in public spaces, but the system behind them connects to your identity provider and your business data. Wallboard supports SAML single sign-on, SCIM provisioning, enforced two-factor authentication and role-based access. TLS 1.2 or higher encrypts traffic to Wallboard cloud. Wallboard follows a documented incident procedure, with engineers on call 24/7. You’ll find the documents behind these controls at the end of this page.
Run Wallboard where your policies require.
Wallboard cloud runs on DigitalOcean. Core data for EU customers stays in EU data centers, and US customers’ data stays in the US. If your policies need data inside your own boundary, Wallboard can host a private instance for you, or you can run it on your own Kubernetes cluster, on a single on-premise server or in an isolated network. Every model runs the same application.
Authentication.
- SAML 2.0 single sign-on with any compliant identity provider, with setup guides for Microsoft Entra ID and Okta.
- Sign in with Microsoft for organizations on Microsoft accounts.
- Optional encrypted SAML assertions and signed authentication requests. You can hide the password fields so users must sign in through your identity provider.
- SCIM 2.0 provisioning from Entra ID, Okta or OneLogin creates and updates users and teams, and deactivates them, so leavers lose access when you remove them from your directory.
- TOTP two-factor authentication that you can enforce for every user. Password changes, user deletion and configuration changes ask for a TOTP code.
- Admin accounts that are not trusted sign in read-only and must verify with 2FA to get a 30-minute write window.
- Configurable password strength rules and session timeouts with automatic token expiry.
- Passwordless login with a one-time code sent by email, which you can switch off.
Authorization.
- Five roles, from View only to Administrator, decide what each person can do. Content Editors create content, and a user with a higher role approves it before it goes live.
- Teams decide which devices and folders each person can reach, and which content and files, with read-only or read and write permission.
- User interface profiles hide menus a person does not need. A profile never grants more than the user’s role allows.
- SAML attributes can set a user’s role and teams, and their UI profile, so access follows your identity provider groups. You choose the default role for users created at first sign-in.
- Restricting an account blocks every login method and ends active sessions straight away, without deleting the user.
- The Logs page records activity with the user, device, content or datasource involved, with filters and CSV export for audits.
Encryption.
- TLS 1.2 or higher for all data in transit to Wallboard cloud.
- Databases in Wallboard cloud are encrypted at rest through DigitalOcean’s managed database service.
- On-premise installs turn on TLS by default, with certificates issued and renewed by cert-manager.
- The REST API uses OAuth 2.0 with authorization code and PKCE.
- Android and Windows players, plus BrightSign and LG, can trust custom certificates, for networks that inspect traffic with their own certificate authority.
Infrastructure.
- Each customer runs in a separate Kubernetes namespace, with logical separation at application and database level.
- Network access controls and ingress policies, Cloudflare DNS, and DigitalOcean load balancers that terminate TLS.
- Continuous monitoring with self-hosted Prometheus and Grafana, central log aggregation, and automated alerts on system health.
- A public sub-processor list gives each provider’s purpose, the data it processes and its location. You get 30 days’ notice before a new sub-processor is added.
- Optional AI features can run on your own AI provider credentials instead of Wallboard-managed ones.
Compliance.
- Wallboard has successfully completed a SOC 2 Type II examination for Security, with no exceptions noted. An independent CPA firm examined the design and operating effectiveness of the security controls included in the report. The examination covered the period 13 April through 12 July 2026.
- A Data Processing Addendum covering GDPR, UK GDPR and CCPA, with Standard Contractual Clauses and the UK Addendum for international transfers.
- A third-party penetration test certificate, available on request.
- An On-Premise Deployment Addendum that sets out which security duties sit with Wallboard and which with your team.
- A designated information security officer, periodic access reviews and regular vulnerability assessments, as set out in the DPA.
Incident response and backup.
- A documented incident procedure with four severity levels, from Low to Critical, and defined escalation paths.
- A 24/7 on-call engineer rotation.
- Notice of a security incident affecting your personal data within 72 hours of Wallboard becoming aware of it.
- Automated daily backups of Wallboard cloud, kept for 90 days.
- When your contract ends, you have 30 days to export your data. Personal data is then deleted, and backup copies expire within 90 days.
- On-premise installs include backup jobs that can copy data offsite to S3-compatible storage. Your team owns backup and recovery for infrastructure it runs.
Get the security pack.
Send us your security questionnaire, or ask for the documents below. It goes to the people who can answer it.
- Data Processing Addendum
- Sub-processor list
- On-Premise Deployment Addendum
- Architecture overview and technical specifications, on request
- Penetration test certificate, on request
- SOC 2 Type II report, on request