Security

Network Requirements

All communication between the CMS and APIs is secured and optimised for bandwidth efficiency.

Protocols & Ports

• All communication takes place over HTTPS (TLS 1.2 or higher) on port 443.
• We recommend also whitelisting port 80, as some external content may be loaded via HTTP.

Communication

• The CMS uses multiple REST API endpoints for content management and integrations.
• Content is delivered via a CDN with delta updates to reduce bandwidth usage and ensure fast refresh.

Whitelisted Domains

Ensure the following domains are whitelisted in your firewall and proxy configuration.

Core CMS & Content Hosting

Common External Content Domains

Security & Access

DS Templates implements multiple layers of security to protect your data and ensure compliance.

Authentication & Authorization

• Federated login via SAML / Microsoft Entra ID
• Role-Based Access Control (RBAC) with custom permissions
• IP whitelisting for administrative interfaces
• Multi-Factor Authentication (MFA) — optional, can be enforced per organisation by administrators

Session Management

• Automatic session expiry after a configurable period of inactivity
• Sessions are invalidated on password change or account deactivation
• Secure, HTTP-only session cookies with SameSite attribute

API Security

• Rate limiting on all API endpoints to prevent abuse
• API key authentication with rotation policies (frequency varies per key type)
• All API traffic over HTTPS exclusively

Encryption & Data Protection

• All communication over HTTPS (TLS 1.2+)
• Sensitive data stored with AES-256 encryption
• Passwords hashed using bcrypt with salt

Data Residency

• Default hosting in EU (Frankfurt, Germany)
• Customers can request EU-only data residency to guarantee all data remains within the European Union
• US hosting available for customers that prefer or require it

Compliance

• Fully GDPR and ISO 27001 aligned
• DS Templates acts solely as a data processor
• Upon contract termination, all data is securely and irreversibly deleted within 30 days
• Data Processing Agreement (DPA) available on request — contact security@digitalsignage-templates.com
• Cyber liability insurance in place covering data breaches and security incidents
• 99% uptime SLA for the cloud platform

Penetration Testing

DS Templates undergoes annual penetration tests conducted by independent, certified third-party security firms. These tests cover the full attack surface including web application security, API endpoints, authentication flows, and infrastructure.

• Frequency: annually (minimum), with additional tests after major platform changes
• Scope: OWASP Top 10, API security, authentication & authorization, infrastructure
• Remediation: all critical and high findings are resolved before the next release cycle
• Reports: penetration test reports are available upon request under NDA

Incident Response

DS Templates maintains a documented incident response procedure aligned with ISO 27001 guidelines:

• Detection & triage — automated monitoring and alerting for security events
• Notification — affected customers are notified within 72 hours of confirmed data breach, in accordance with GDPR Article 33
• Containment & remediation — immediate measures to contain the incident, followed by root cause analysis
• Post-incident review — lessons learned documented and preventive measures implemented

Vulnerability Management

• Dependencies are monitored for known vulnerabilities (CVEs) and patched regularly
• Infrastructure patches are applied within 30 days for critical vulnerabilities, 90 days for non-critical
• Code reviews are performed on all changes before deployment to production
• Responsible disclosure: security researchers can report vulnerabilities to security@digitalsignage-templates.com

Backup & Disaster Recovery

• Daily automated backups of all databases and file storage
• Backups are encrypted (AES-256) and stored in a geographically separate location within the EU
• Recovery Point Objective (RPO): 24 hours
• Recovery Time Objective (RTO): 4 hours
• Disaster recovery procedures are tested periodically

Business Continuity

DS Templates maintains a Business Continuity Plan (BCP) to ensure service availability during disruptions:

• Documented procedures for infrastructure failure, data centre outage, and key personnel unavailability
• Geo-redundant infrastructure with automatic failover
• BCP is reviewed and updated annually
• BCP documentation available on request — contact security@digitalsignage-templates.com

Audit Trail & Logging

• All user actions (login, content changes, API calls) are logged with timestamp, user ID, and IP address
• Logs are retained for a minimum of 12 months
• Access to logs is restricted to authorised personnel only

Employee Security

• All employees sign confidentiality agreements
• Access to production systems follows the principle of least privilege
• Multi-factor authentication (MFA) required for all internal systems
• Regular security awareness training for all team members

Server Locations

Production infrastructure is hosted across certified data centres with full redundancy.

Sub-processors — Personal Data Processing

The following sub-processors process personal data as part of the DS Templates Data Processing Agreement (DPA). These are mandatory inclusions.

Sub-processors — End-User Data (Optional Modules)

These sub-processors process personal data of the customer's end-users. They apply only when the customer activates the corresponding module.

Sub-processors — Public Data Only

These services process only public or non-personal data and are likely not required as sub-processors under GDPR.