Compliance
Security and compliance answers
What a security, compliance, privacy or procurement review asks Screenly, with the answer, a status and the date it became true. Where the answer is no, it says so. Certificates, reports and SBOMs are in the trust center.
Open the trust center (opens in a new tab)46 answers, checked
Audits and certifications
- Does Screenly have a SOC 2 report?
- Yessince May 2025
- Yes. A SOC 2 Type II report, audited against all five trust criteria.
- Is Screenly certified to ISO/IEC 27001?
- Yessince August 2026
- Yes, to ISO/IEC 27001:2022. The certificate covers the cloud platform, the software on the device, the APIs and support.
- Has Screenly had a penetration test in the last twelve months?
- Nosince November 2023
- No. The last published test was in November 2023, by ControlPlane.
- Has Screenly signed CISA's Secure by Design pledge?
- Yessince July 2024
- Yes, as the first digital signage company to sign it.
- Is Screenly a member of the IoT Security Foundation?
- Yessince September 2026
- Yes.
- Is Screenly HITRUST certified?
- No
- No.
- Does Screenly have FedRAMP, GovRAMP or TX-RAMP authorization?
- No
- No.
- Is Screenly certified to IEC 62443?
- No
- No. Screenly holds no IEC 62443 certificate and has published no gap statement. An SBOM is published for each ScreenlyOS release.
- Does Screenly hold UK Cyber Essentials?
- No
- No.
Documents for your review
- Can we see the SOC 2 report?
- On requestsince May 2025
- Yes, under NDA. Request it from the trust center at trust.screenly.io.
- Can we see the ISO/IEC 27001 certificate and report?
- On requestsince August 2026
- Yes. Request them from the trust center at trust.screenly.io.
- Is there an SBOM for the device software?
- Yessince 2024
- Yes. SBOMs for Screenly, the Screenly Player Max models and Anthias are published in the trust center at trust.screenly.io, produced and attested for each release.
- Is there a completed SIG or CAIQ questionnaire?
- No
- Not yet. We answer your questionnaire directly.
- Is there a recent penetration test letter?
- No
- No. The last published test is from November 2023.
- Is there a data processing agreement?
- No
- Not published. Ask us if your review needs one.
Data and hosting
- Where is our data hosted?
- On Amazon Web Services and Google Cloud, processed in the United States.
- Can we choose where our data is hosted, such as the EU?
- No
- Not today. Data is processed in the United States.
- Is there a list of the companies that process our data?
- Yes
- Yes. Every company that processes customer data is on the sub-processors page, with what it does and what it receives.
- Does Screenly send our content to an AI model?
- No
- No. Screenly has no built-in AI and sends nothing to an AI model. Your team can connect its own assistant through the Screenly MCP server, limited to what its API token allows.
- Are the credentials for dashboards and APIs kept encrypted?
- Yes
- Yes. Each one is encrypted for the one device that uses it, or kept on Screenly's servers where a device cannot hold it.
Regulated industries
- Does Screenly store patient data?
- No
- No, by design. Queues call a ticket number to a counter or room, never a name.
- Does Screenly sign a HIPAA business associate agreement?
- No
- Not today. Screenly stores no patient data by design, and a public screen should not show any.
- Does Screenly publish a 21 CFR Part 11 statement?
- No
- No. Screens show regulated records rather than hold them.
- Is Screenly aligned with CMMC, or able to offer US-only data and support?
- No
- No.
- Is there an on-premises or air-gapped version?
- No
- No. Screenly runs in the cloud. Anthias, Screenly's open-source project, is a separate product people host themselves.
- Does Screenly keep a record of what each screen played?
- On requestsince August 2026
- Yes, on any screen, on request. Proof of play records each item a screen played and for how long, including anything that failed to load, and a ScreenlyOS device keeps the records for up to 31 days through an outage. It is off by default, and the dashboard does not show the records yet.
Accessibility
- Does the Screenly dashboard meet WCAG 2.2 AA?
- No
- Not confirmed. The dashboard has not been assessed against WCAG 2.2 AA, so Screenly makes no conformance claim for it yet.
- Is there a VPAT or accessibility conformance report?
- No
- Not yet. The dashboard has not been assessed against WCAG.
Sign-in and access
- Can an account be taken over with a leaked password?
- Nosince May 2026
- No. Screenly accounts have had no passwords since 21 May 2026. People sign in with a passkey, an email code, Google, GitHub or Microsoft.
- Is there multi-factor authentication?
- Yes
- Yes. Passkeys resist phishing, and two-factor authentication can be added on top.
- Can people sign in through our identity provider?
- Yes
- Yes, with SAML on the Enterprise plan, for providers such as Okta, Entra ID and Google Workspace.
- Is there role-based access control?
- Yes
- Yes. Roles set what each person can do in a workspace, and workspaces separate teams and sites.
- Can access end on a set date?
- Yes
- Yes. A member can be given an end date, after which their access ends on its own.
- Is there an audit log?
- Partly
- Enterprise accounts see each action a user took and when. Retention, export and SIEM forwarding are not stated yet.
ScreenlyOS devices
- Can a device be reached or logged in to remotely?
- No
- Not a ScreenlyOS device. It has no open ports, no default credentials and no backdoors, and connects outbound only.
- Are device updates signed and checked?
- Yes
- Yes. Updates arrive automatically, signed and transactional, and a ScreenlyOS device rejects any update that fails verification.
- Is traffic between the device and the cloud authenticated?
- Yes
- Yes, ScreenlyOS devices use mutual TLS. On devices with a TPM, the key is kept in the TPM.
- Do devices have a TPM and Secure Boot?
- Partly
- Screenly Player Max does. Each boot stage checks the next, and the TPM holds the device's identity.
- Can devices join a network that requires 802.1X?
- Partly
- Partly. ScreenlyOS devices join 802.1X networks with PEAP over Wi-Fi and Ethernet. Certificate-based 802.1X (EAP-TLS) is not supported.
- Can our internal pages be served only to our screens?
- Yessince 2026
- Yes. A ScreenlyOS device presents its own certificate when it loads your pages, so a page can refuse anything else.
- Do screens keep playing when the network goes down?
- Yes
- Yes. ScreenlyOS devices keep playing what they hold and switch playlists on schedule, and restart their own networking or reboot if contact with Screenly does not come back.
- Are end-of-life dates published for the device software?
- Yes
- Yes. End-of-life dates for ScreenlyOS are published.
Vulnerabilities and incidents
- Can we report a vulnerability?
- Partlysince 2024
- Partly. The vulnerability disclosure program and the contacts in our security.txt file take reports, but new bug bounty reports have been paused since 14 May 2026 while earlier ones are worked through; reports are acknowledged within three business days.
- Are security advisories published?
- Yes
- Yes, in the trust center at trust.screenly.io, with what each affects and where the fix is. None has been published so far.
- Does Screenly publish its security incidents?
- Yes
- Yes, with what happened and how we responded, such as the November 2025 report of leaked account data.
- Is there a public status page?
- Yes
- Yes, at status.screenly.io.