Security
Digital signage security at Screenly
Cloud digital signage is as secure as the player on the wall, the path its content takes and the accounts that control it.
Why signage is a target
A screen is always on, in a public place, and often unattended. Taking one over embarrasses an organization in front of everyone walking past, and a player on the corporate network can be a way in to everything else on it. Signage players are IoT devices, and the industry's record with them is poor: default credentials, open ports, and devices that stop getting patches long before they come off the wall. The attacks keep coming, through a phished login, a flaw in the software that sends content, or a device nobody patched.
- October 2026 A flaw in LED display software puts explicit video on billboards in Egypt, Malaysia and Brazil
- October 2025 Flight information screens and PA systems at four airports in Canada and the US are hijacked
- April 2025 A phishing attack reaches the menu boards at nearly 300 Mary Brown's restaurants in Canada
Cloud or on-premises
Moving signage off your own server changes who patches it, what is exposed and who you trust. Screenly answers each of those concerns, and says plainly when on-premises is still the right call.
- 01No server of yours to patch or expose
- 02Screens connect out, nothing connects in
- 03Audited for SOC 2 Type II and ISO/IEC 27001:2022
On ScreenlyOS devices
Applies to: ScreenlyOS, unless an item says otherwise
Devices running ScreenlyOS are built on the assumption that they are reachable from the internet, so nothing on them waits to be used against them.
A hardware root of trust
Applies to: Screenly Player Max
Player Max has a TPM and Secure Boot. Each stage of the boot process verifies the next before handing over control, so tampered firmware does not boot, and the TPM gives the device an identity that cannot be copied off the board.
Processes kept apart
Linux kernel namespaces, cgroups, AppArmor and Seccomp isolate every process. If one part of the device is compromised, the attacker cannot move to the rest, run system commands or install tools.
Signed, transactional updates
Operating system and software updates install automatically without interrupting playback. Every update is cryptographically signed, and a ScreenlyOS device rejects anything that fails verification. An update applies completely or not at all.
Nothing to log in to
ScreenlyOS devices have no open ports, no default credentials and no backdoors, in line with the EU Cybersecurity Act and the US IoT Cybersecurity Improvement Act of 2020.
Dependencies audited
Third-party dependencies are audited regularly, and every release ships with a software bill of materials.
A published end of life
The end-of-life dates of the operating system are public, with a plan for devices that cannot be updated remotely, so no device keeps running unpatched without anyone knowing.
On the network
Applies to: ScreenlyOS, unless an item says otherwise
A ScreenlyOS device joins your network on the same terms as a managed laptop, and reaches what it needs without anything being opened to the internet.
Mutual TLS to the cloud
All traffic between a ScreenlyOS device and Screenly is encrypted, and both sides prove who they are before anything is exchanged. On devices with a TPM, the private key is kept in it.
Device certificates for your own servers
Applies to: ScreenlyOS 26.2.0 and later
Every ScreenlyOS device has its own certificate, and your servers can ask for it before serving a page. An internal dashboard opens for your screens and is refused to every other device, at your server or at a CDN or load balancer in front of it.
802.1X network access
ScreenlyOS devices authenticate to 802.1X networks with PEAP, over Wi-Fi and wired Ethernet, so they need no separate VLAN or policy exception where network access control is required.
Your private network, nothing exposed
ScreenlyOS devices can join your Tailscale network and reach internal pages and private APIs the way your own machines do. The integration asks for one permission, auth keys, and nothing else.
In the cloud
The service behind the screens is run the way ScreenlyOS is built: isolated, scanned and short-lived.
Servers replaced every 24 hours
Servers are short-lived and replaced every day, so each one runs with the latest patches.
Continuous vulnerability scanning
The runtime environment is scanned continuously, application dependencies and containers alike.
Processes kept apart
The same kernel-level process isolation used in ScreenlyOS limits what any one compromised process could reach.
Sign-in and access
Most breaches start with an account. Screenly removed the most common way in and keeps every account to the access it needs, for as long as it needs it.
No passwords at all
Since 21 May 2026 there is no password to reuse, leak, phish or guess on a Screenly account. People sign in with a passkey (FIDO2 and WebAuthn, including hardware keys), a one-time email code bound to the browser session that asked for it, single sign-on with Google, GitHub or Microsoft, or SAML with your own identity provider. TOTP two-factor authentication can be added on top.
Role-based access control (RBAC)
Every workspace member has a role, such as Owner, Admin, Billing Manager or User, so people get the access their job needs and no more.
Access that ends on its own
A member can be given an Active until date, and their access ends that day. Members can also be disabled and enabled again without touching screens or content, so access provably ended when someone left.
Workspaces as the boundary
Applies to: Linked workspaces on the Enterprise plan
Separate workspaces per site, department or business unit keep access and content apart and limit what any one compromised workspace could reach. Linked workspaces share one pool of licenses and one invoice, so the separation costs nothing.
No built-in AI
A model inside a signage platform is one more system with access to your content and a route to your public screens. Screenly leaves it out. Your team can connect the assistant it already uses, with no more access than a token you set.
- 01Nothing in your workspace is sent to a model
- 02Your own assistant, connected on your terms
- 03Access no wider than a token you control
Credentials on screens
A screen that shows a dashboard, a rates feed or an internal page needs credentials to reach it. Screenly stores each one encrypted for the one device that uses it, holds service connections for the whole workspace, and on a TV, a stick or a web browser, which cannot keep a secret, renders the content on our servers so the credential never reaches the device.
- 01Encrypted for the device that uses it
- 02Never readable back, in a URL or in the page source
- 03Kept on our servers where a device cannot keep it
What to ask any signage vendor
The questions a security review should cover, and Screenly's answer to each.
| Ask | Screenly |
|---|---|
| Is the platform independently audited? | Yes. SOC 2 Type II since May 2025, and ISO/IEC 27001:2022 since August 2026, with the software on the player in scope. |
| Can a device be reached or logged in to remotely? | Not a ScreenlyOS device. It has no open ports, no default credentials and no backdoors. |
| How are updates delivered and checked? | Automatically, signed and transactional. A ScreenlyOS device rejects any update that fails verification. |
| Is traffic between the device and the cloud authenticated? | Yes, ScreenlyOS devices use mutual TLS. On devices with a TPM, the key is kept in the TPM. |
| Can devices join a network that requires 802.1X? | ScreenlyOS devices can, with PEAP over Wi-Fi and Ethernet. |
| Where do the credentials for dashboards and APIs live? | Encrypted for the one device that uses them, or kept on our servers where a device cannot hold them. |
| Can an account be taken over with a leaked password? | No. Screenly accounts have had no passwords since 21 May 2026. |
| Does the platform send our content to an AI model? | No. Screenly has no built-in AI. If your team wants an assistant, it connects its own, with the access of a token you control. |
| How long is the software supported? | End-of-life dates for the operating system are published. |
| How are vulnerabilities and incidents handled? | Through a bug bounty and disclosure program, and incidents are published with the response to them. |
Incidents and updates, in public
Screenly keeps a public record of security incidents and how we responded, such as the November 2025 magic link incident, alongside security updates as they ship.
Report a vulnerability
The bug bounty and vulnerability disclosure program covers scope, safe harbor, how to report, rewards and our PGP keys. Contact details are also in our security.txt file. The security team watches that inbox and acknowledges every report within one business day.
Questions
Is cloud digital signage secure?
Yes, when the device, the network path and the accounts are each secured. With Screenly, ScreenlyOS devices have no open ports or default credentials, updates are signed, traffic uses mutual TLS, and accounts have no passwords. The platform is audited for SOC 2 Type II and certified to ISO/IEC 27001:2022.
What makes a digital signage platform secure?
Independent audits, players that cannot be logged in to remotely, signed automatic updates, encrypted and authenticated traffic, credentials kept off devices that cannot hold them, sign-in that cannot be phished, and a public way to report vulnerabilities.
Is Screenly SOC 2 and ISO 27001 certified?
Screenly has a SOC 2 Type II report since May 2025 and ISO/IEC 27001:2022 certification since August 2026, with the software on the player in scope.
Does Screenly send my content to an AI model?
No. Screenly has no built-in AI and sends nothing to an AI model. Your team can connect its own assistant through the Screenly MCP server, limited to what its API token allows.
Where do I report a vulnerability?
Through the bug bounty and vulnerability disclosure program, or the contacts in our security.txt file. Reports are acknowledged within one business day.