Built-in boundaries
A clear look at the controls implemented in our pilot today. No certification badges, uptime promises or features that only exist on a roadmap.
The pilot is hosted on Microsoft Azure Static Web Apps in West Europe, EU, with private Azure storage for uploaded media, and is moving to Cloudflare, with its database and media storage in Cloudflare’s EU jurisdiction. Resend delivers sign-in, invitation and contact email. EU hosting is not a promise of EU-only processing by every provider.
Sign in with a one-time email link or code, not a password. Normal sign-in links and codes expire after 15 minutes. Codes also require the requesting browser’s short-lived cookie and allow five attempts. Approved access-request links last three days and work once.
Admins manage access and TV pairing. Publishers can edit and publish; editors cannot publish. The API checks the current membership on each private request. Signing in alone does not grant access to a workspace.
An admin connects a TV using its two-word code, which expires after ten minutes. For new pairings, the TV keeps a random 256-bit key and the server stores only its hash. The code is not a credential, and the TV key cannot call app administration endpoints.
Upload permissions last 15 minutes and are limited to one quarantine file. The server validates media before it is ready to use. Media read links expire after one hour. Public website example images are separate from private uploads.
A strict Content-Security-Policy restricts scripts to our own origin. Security headers block framing of the site and suppress referrers. API writes require the expected origin, JSON and an application header. These browser checks do not replace authentication or stop every automated client.
Saving creates an immutable campaign or playlist version. Publishing explicitly changes the display’s version pointer. Conflicting writes are rejected. TVs download and verify uploaded media before switching, keeping the previous complete content if a download fails.
Games on /games need no login. Scores and sound preferences remain on the device. Public pages are marked noindex, but that is not access control: their website files are still public.
When turned on, a screen game’s score is decided on our server: the phone only sends taps or button presses, and the server counts the answers or replays the round from its own seed before it decides the leaderboard and any prize. Join, controller and prize secrets are random 256-bit values stored only as hashes. A prize is redeemed once, by signed-in staff, with a single conditional write.
Revoking a TV key blocks future network access, not content already cached on that TV. First use needs internet, and browser storage can be cleared or evicted. Customer-added social posts depend on TikTok or Instagram and may require their consent or login.
The pilot has seven-day blob soft-delete and version retention, not a backup of all database metadata. Scheduled metadata exports and a tested full restore are still prerequisites for routine production. We do not offer an uptime guarantee or claim security certification.
Found a possible issue? Send a short description, the affected page and safe steps to reproduce it. Do not include live credentials or other people’s data. Avoid disruptive testing; we can arrange a suitable way to share sensitive details by email.
showesy