Security

Player Software

To display DS Templates content on external media players, the DS Templates Player Software must be installed.

Available Versions

Network Requirements

All communication between players, CMS, and APIs is secured and optimised for bandwidth efficiency.

Protocols & Ports

• All communication takes place over HTTPS (TLS 1.2 or higher) on port 443.
• We recommend also whitelisting port 80, as some external content may be loaded via HTTP.

Communication

• Both the player software and the CMS use multiple REST API endpoints.
• Content is delivered via a CDN with delta updates to reduce bandwidth usage and ensure fast refresh.

Device Pull Model & Scaling

• Players operate statelessly and periodically check for updates.
• Only modified content ("deltas") is downloaded, enabling efficient caching and reliable offline playback.

Whitelisted Domains

Ensure the following domains are whitelisted in your firewall and proxy configuration.

Core CMS & Content Hosting

Common External Content Domains

Security & Access

DS Templates implements multiple layers of security to protect your data and ensure compliance.

Authentication & Authorization

• Federated login via SAML / Microsoft Entra ID
• Role-Based Access Control (RBAC) with custom permissions
• IP whitelisting for administrative interfaces

Encryption & Data Protection

• All communication over HTTPS (TLS 1.2+)
• Sensitive data stored with AES-256 encryption
• Passwords hashed using bcrypt with salt

Compliance

• Fully GDPR and ISO 27001 aligned
• DS Templates acts solely as a data processor
• Upon contract termination, all data is securely and irreversibly deleted

Server Locations

Production infrastructure is hosted across certified data centres with full redundancy.

On-Premise Installations

While DS Templates is primarily cloud-hosted, on-premise deployment is available for customers requiring local hosting due to security, compliance, or offline needs.

Supported Operating Systems

• Debian / Ubuntu Server
• Red Hat Enterprise Linux (RHEL)
• CentOS Stream
• Other enterprise Linux distributions (subject to compatibility testing)

Containerized Deployment (Docker)

• On-premise requires a Docker-based installation.
• Delivered as one or more Docker containers for consistency and easy maintenance.
• Supported with Docker Compose or orchestration (e.g., Kubernetes) following provided guidelines.

Minimum Server Requirements

Example Hardware

A DELL EMC PowerEdge T150 provides a reliable foundation for on-premise hosting:

• Intel Xeon E-2300 series processor
• 8–16 GB ECC DDR4 RAM
• Enterprise-grade SSD storage
• Optional redundant PSU for higher availability

Network & Security Requirements

• Enable HTTPS (TLS 1.2+) for all CMS and API endpoints
• Open ports: 443 (required), 80 (optional for external content)
• Whitelist required core and integration domains (see Whitelisted Domains)
• Use internal DNS or static IP for stability

Responsibilities

• Provision and maintain server hardware or VM
• Apply OS patches and security updates
• Manage firewall and network configuration
• Perform backups per internal policy (procedures available on request)
• Ensure resources for high-availability/scaling if required

Support & Maintenance

• Installation guidelines, Docker configuration, and initial deployment assistance provided
• Pull ongoing application updates via Docker image updates (per change management)
• Optional remote support via secure VPN or jump-host

Sub-processors — Personal Data Processing

The following sub-processors process personal data as part of the DS Templates Data Processing Agreement (DPA). These are mandatory inclusions.

Sub-processors — End-User Data (Optional Modules)

These sub-processors process personal data of the customer's end-users. They apply only when the customer activates the corresponding module.

Sub-processors — Public Data Only

These services process only public or non-personal data and are likely not required as sub-processors under GDPR.