Trust Center
Security and compliance
Security isn’t an add-on to our platforms, it’s the foundation of how we design and run them. On this page you’ll find the controls, commitments and documentation that security, risk and compliance teams need to assess us as a vendor.
Security controls
Encryption
All communications encrypted in transit with TLS 1.3, and encryption of data at rest available on demand.
Access control
Least privilege, two-factor authentication, single sign-on (SSO) and an audit log of every administrative action.
Secure development
A secure development lifecycle aligned with OWASP and NIST SSDF, with automatic security checks on every deployment.
Vulnerability management
Server hardening, periodic scans and planned patching.
Perimeter protection
All traffic goes through Cloudflare, acting as CDN and web application firewall: access ACLs, geoblocking, rate limiting and OWASP rules that block web attacks before they reach the platform.
Continuous monitoring
Detailed supervision of infrastructure, services and players, with proactive alerts.
ITIL 4 operations
Configuration, incident, problem and change management with documented, auditable processes.
Certified isolation of dedicated instances
For clients that can’t share infrastructure with third parties, we offer fully isolated dedicated instances, backed by an isolation certificate.
What a dedicated instance includes
Each client has its own resources, not shared with any other organization:
- Application servers on dedicated virtual machines
- Exclusive database and storage
- Isolated network segment
- Its own encryption keys
- Separate administrative credentials and access
- Separate backups
Isolation certificate
We issue a certificate that formally states that the client’s instance is isolated and shares no logical resources with other clients, together with the technical evidence behind it.
Dedicated instances
No resources shared between clients
Business continuity
Our continuity commitments are expressed in measurable figures, not general promises. The values are agreed by contract with each client, according to their needs.
| Indicator | What is committed |
|---|---|
| Target availability | The percentage of time the service is operational. |
| RPO (maximum data loss) | How much information could be lost in a serious incident. |
| RTO (maximum recovery time) | How long it takes to restore the service. |
| Backup frequency | How often the information is copied. |
| Backup retention | How long copies are kept. |
| Backup location | Where copies are stored. |
| Restore tests | How often we check that copies can be recovered. |
Service continuity in the stores
Digital signage players keep showing their stored schedule even if they lose the connection to the platform, and in air-gapped environments the local middleware keeps operations running independently. The Ti-Vi Music hardware player has a local backup and resumes the stream when the connection returns.
Frameworks
Our processes
They’re aligned with the frameworks that regulated sectors usually require:
- ISO/IEC 27001 (information security), as a reference framework
- ITIL 4 (service management)
- OWASP and NIST SSDF (secure development)
Our infrastructure
The platforms run on providers with their own certifications:
- Akamai Cloud (Linode): ISO/IEC 27001, 27017, 27018 and 27701, SOC 2 and PCI DSS
- Cloudflare: ISO/IEC 27001 and 27701, SOC 2 Type II and PCI DSS Level 1
Documentation for vendor assessments
Available to security and risk teams under a non-disclosure agreement:
- Architecture diagrams
- Information security policies
- Instance isolation certificate
- Continuity and disaster recovery plan
- Configuration item inventory
- Responsibility matrix
- Answers to vendor security questionnaires
Frequently asked questions
Does my instance share infrastructure with other clients?
Not in the dedicated instance model. Each client has its own resources, and we certify it with an isolation certificate.
What do RPO and RTO mean?
RPO is the maximum amount of information that could be lost in a serious incident, and RTO is the maximum time to restore the service.
How do I request the security documentation?
Through the contact form. Once a non-disclosure agreement is signed, we send the documentation to the assessment team.
Does your client need to assess us as a vendor? We send the documentation to their team once a non-disclosure agreement is signed.