Skip to content
SLX On Air

SLX On Air

Security

This page describes the security and privacy controls in SLX On Air as they work today, including their limits. It is written for people evaluating us — IT, security and procurement teams — so it states what we do rather than what we would like it to sound like. If something you need isn't here, ask and we'll answer directly.

Data protection

  • Encrypted in transit, everywhere. TLS 1.3 on the website and console; HTTP redirects to HTTPS.
  • Our apps won't trust a certificate added to your phone. They trust only the operating system's own root certificates, so interception tooling that works against a browser doesn't work against them.
  • Encrypted at rest by our managed cloud platforms.
  • Application credentials are held in server configuration, never in source code.
  • Residency. Our primary database is hosted in Mumbai, India. Media storage, outbound email and payment processing are also handled within India. Some global services we rely on — sign-in, content screening, maps and analytics — are operated by Google and may process data outside India.
  • Retention is published and enforced in code. Crash logs 90 days. Device health tiered from 30 days of full detail to a year of daily summaries. Proof-of-Play raw events 90 days, summaries two years. Administrative audit records two years. Invoices per statutory requirement.
  • Deletion is a workflow, not a support ticket.
  • Invoices and Proof-of-Play reports are delivered through expiring, access-checked links.
  • Public API endpoints are rate limited, returning 429 above threshold, and inbound webhooks are signature-verified with HMAC-SHA256.
  • Served with HSTS, a strict framing policy and browser-enforced hardening headers. Preload is submitted.
  • We never touch your card details. Payments go to our PCI-DSS-compliant gateway; we store an order reference and an amount.
  • A published sub-processor list, covering what each receives and why. The timestamping authority receives only a cryptographic hash.
  • A vulnerability-disclosure contact at /.well-known/security.txt, RFC 9116, with a monitored mailbox.

Limits

  • Content posted to a board is public by design, because a board is a public screen. It is not private or access-controlled.
  • Our support staff can view customer content through an internal console, under named controls.
  • We can capture a screenshot of a screen for diagnostics on request. Screenshots capture the public display only.

Access & identity

  • No passwords. Sign-in is Google, Apple, or a one-time emailed link. Nothing is created, stored or transmitted, and we hold no password database.
  • If your organisation enforces two-step verification on Google or Apple, it applies to your console too — you sign in through your own identity provider.
  • Short-lived tokens that renew silently, so a captured credential has a limited life.
  • Signing out ends the session on the device and on our servers. The app is wiped to a fresh-install state and the credential is invalidated immediately rather than left to expire.
  • Session credentials are held in the phone's secure hardware store and are never copied into cloud backups.
  • Organisation roles — owner, admin, billing — govern the console. Board posting permissions are a separate content-moderation model.
  • The server is the authority. Client-side checks are presentation only.
  • Cross-site request forgery is structurally impossible: authorisation travels in an explicit header, never an ambient cookie, so a cross-site request carries no credentials.
  • Administrative actions in our console are audit-logged — who, what, when, to what, and whether it succeeded — and retained for two years. Actions taken on a Smart Box itself are logged locally on the device and are not part of that retention.

Limits

  • No SSO/SAML or enforced MFA today — available for enterprise deployments on request.
  • No self-service session revocation, no customer-visible audit trail, and no forced session expiry.

The Smart Box on your network

  • Outbound-only in normal operation. No inbound connection is required; every connection is initiated by the box. No VPN, no port forwarding, no inbound firewall rule. A time-limited diagnostic port can be opened only when we authorise it for support.
  • It never scans or reaches anything else on your network — no mDNS/Bonjour, no SSDP/UPnP, no subnet sweeping, no SMB or printer discovery.
  • It runs on an isolated guest VLAN with no route to internal systems, and needs no static IP or DHCP reservation.
  • Your Wi-Fi password never reaches our servers. It goes from your phone to the box over a direct short-range Bluetooth link — never transmitted to us, never written to our app's storage, never logged.
  • It's an appliance, not a computer. No home button, no menu, no app drawer, no way to close the app from the screen, and USB debugging disabled on production devices.
  • Routine support uses a fixed allowlist of commands the box itself enforces — reboot, refresh content, clear cache, and capture a screenshot of the public display.
  • For deeper diagnostics we can open privileged maintenance access to a box. It is off by default, must be authorised from our console, is time-limited, and expires automatically.
  • The screen keeps playing when the internet doesn't.
  • Take-down is immediate — remove something in the console and it's off the screen within minutes.

Software updates

  • Application updates are signed and signature-verified by the device before installation. The operating system refuses any update not signed with our key, and the signing key never travels with an update.
  • This is what stops a malicious update server. Even with full control of our update servers, an attacker could not install substituted software.
  • A hostile network can delay updates, not change them. A redirected or intercepted connection fails validation and is dropped. There is no fallback to an unverified path.
  • Rollouts are staged and can be halted at any point.
  • A failed update restores the previous version automatically and blocks the bad one from retrying. Power loss mid-update leaves the box on the version it had.
  • If the app stops running, the device restarts it by itself, escalating to a reinstall from a local backup.
  • Security fixes typically reach the fleet within 24 hours, without a site visit.
  • Update reports contain device identity, versions and outcomes — never your content.

Limits

  • Scoped to SLX On Air application software — operating-system patching is the hardware vendor's responsibility.
  • Customers cannot defer, schedule or approve updates.

Proof of Play

  • Available on Pro boards, enabled per board.
  • Tamper-evident records. Each play is recorded in a chain where every entry mathematically depends on the one before it, so nothing can be inserted, deleted, reordered or edited afterwards without the chain visibly breaking — including by us.
  • Signed on the device with an elliptic-curve key generated inside the box's secure key store, which cannot be exported.
  • Timestamped by two independent authorities — freetsa.org and DigiCert — and the timestamps are published. Anyone can download the raw RFC-3161 tokens and verify them without trusting us.
  • Anyone can verify a report at our public verification portal, with no account.
  • Where the panel reports its state, we can tell whether the TV was actually receiving a signal over HDMI. Screen-time we can vouch for is shown as verified; time we can't is disclosed separately.

Limits

  • It proves the player rendered the content — not that a person saw it. An unsensed screen in an empty room produces identical records.
  • Some TVs keep their HDMI receiver powered in standby and never report a change; those are graded panel unknown rather than counted as verified.
  • It is not audience measurement — no impressions, no dwell time, no demographics.
  • Integrity is guaranteed from the moment the box recorded the event onward. A re-provisioned box restarts its chain — expected and visible, not a break.
  • Signing is near-universal, not absolute. If the device's key store is briefly unavailable the batch is uploaded unsigned rather than discarded — losing a play record is worse than an unsigned one. Rare and deliberate, and stated because this page is about being careful.

Privacy & tracking

  • Nothing is tracked on this website until you agree. Analytics and advertising storage default to denied before any tag loads, with per-category choice you can withdraw later — verifiable from any browser's network tab.
  • No advertising SDK, no advertising identifier, no data sold to brokers — which is why the apps never show the "allow tracking?" prompt.
  • The Smart Box reports device telemetry only — its own address, board, app version, uptime, network type and signal, temperature, and which content played when. It ships with no camera or microphone.
  • The apps never ask for your microphone, your contacts, or background location.
  • Location is a single approximate reading, not a trail. On iOS it is when-in-use, about 100 m, and stops after the first fix. On Android it is requested in context rather than at launch, the app works without it, and Bluetooth scanning is declared neverForLocation.
  • Analytics and crash reporting are Firebase only, carrying technical tags and our own user id — no post text, no photos, no message content — and can be switched off in the app.
  • We never access your photo library. You choose photos in your phone's own picker.
  • Privacy built around India's DPDP Act, with a documented data inventory, purpose record and retention schedule. Minimum age is 13.

For enterprise & healthcare

  • We are public-display signage, not a healthcare data system. No clinical integration, no HL7/FHIR, no patient identifiers anywhere in our data model.
  • All content is customer-authored and intended for public display, so patient data must never be posted to a board — the same rule that applies to the lobby noticeboard we replace.
  • Wired Ethernet is the recommended enterprise installation. Plug the box in and setup is skipped entirely.
  • Our support staff cannot sign in as you — there is no impersonation feature.
  • Our support staff can act on your account, and every action they take is recorded, with two-year retention.

Limits

  • No external penetration test has been carried out.
  • No certificate pinning in our mobile apps, deliberately — it is incompatible with the TLS inspection many enterprise networks run. The Smart Box's update agent is different: it validates against its own bundled certificate authorities rather than the device trust store, so networks performing TLS interception should allowlist our update endpoints rather than intercepting them. Tell us and we'll provide the list.
  • We publish no SLA or uptime figure.

Security pack

A fuller written answer for a security review — controls, sub-processors, retention, and the things we deliberately don’t do, with the reasoning. Sent to your inbox.

Request the security pack