VuePilot provides a number of security mechanisms to help keep your data and machines secure.
\nThis article will outline some of the security controls implemented across the VuePilot platform and aims to clear up some confusion about how parts of the service work from a security perspective.<\/p>\n
All communications between the client and our servers performed over TLS \/ SSL encrypted communications.\u00a0 This includes the VuePilot software and communications with our APIs.
\nAll communications between our internal services and our databases are also performed over encrypted connections.<\/p>\n
Our databases are “encrypted at rest<\/em><\/strong>” by default using LUKS\u00a0 disk encryption.<\/p>\n User passwords are never stored in the database.\u00a0 Passwords are hashed using a strong one way hashing algorithm and stored in an irreversible format. Authentication is performed by re-hashing new passwords and comparing to the stored hash.<\/p>\n Two factor authentication is enabled by default for all users unless specifically disabled.\u00a0 If we detect that a different device is attempting to access your account you will be emailed a security code which must be inputted into a form before you can continue to access the dashboard.<\/p>\n The VuePilot software displays “Rotations” on the screens in your business, a rotation consists of “Pages”, a page can be either a regular website URL or an “App” which is a collection of configuration items with instructions on how to display the content such as positioning, sizing, layouts etc. The VuePilot player requests the “Rotation” from the API at regular intervals and uses this information to drive what is displayed on screen.\u00a0 The VuePilot player software will simply display what is configured to display within the rotation. When using private dashboards, websites or services like Power BI in your rotation is it neccessary to login to the website by using a method such as the “Rotations > Preview > Login<\/em>” method outlined here Logging Into Websites That Require Authentication<\/strong><\/em><\/a><\/p>\n It is important to note that this happens on the device connected to your screens running the VuePilot software and that the VuePilot software is running it’s own version of Chromium, hence you are logging into the website just like a normal browser. All assets stored in the VuePilot media manager are available\u00a0publicly.\u00a0\u00a0<\/strong>All VuePilot media manager assets will have a unique public URL, specific to your account that makes it unlikely to be discovered (ie https:\/\/assets.vuepilot.com\/uploads\/3839\/e8d-myimage.jpg)<\/em> however you should never store any private or highly sensitive information within the media manager as it can be viewed by anyone with the direct link.<\/p>\n Customers may use their own internal company file storage solutions for sensitive information such as sales figures, internal processes, product data, charts etc.\u00a0 When using internal URLs to sensitive content only the URL is ever sent to our servers in order to sychonize what content is to be displayed across your devices. The actual content will never leave your internal network.<\/p>\n The VuePilot media manager is intended for usage with standard public web assets, promotional material, images, video, photos etc.<\/p>\n Customers often mistake this feature for a “Remote Desktop” product like VNC or Windows Remote Desktop. VuePilot does not<\/strong> provide remote desktop functionality or any type of functionality that would allow any individual to control the player machines operating system from a remote location. VuePilot cannot see your desktop, nor can it provide functions such as mouse control or any form of manipulation of the operating system outside of the standard VuePilot uses.\u00a0 The “Remote Management” features are merely JSON requests being passed back and forwards between client and server with minimal information, such as “display URL: https:\/\/cnn.com<\/em>“<\/p>\n Only a small set of remote management instructions can be sent between the client and server, these are to perform basic operation such as<\/p>\n The VuePilot player software is updated often to apply security patches and the latest Chromium releases.\u00a0 \u00a0It operates in a “context isolation” mode which isolates memory from the windows displaying content from the main application process to prevent malicious browser exploits.<\/p>\n Automatic updates are performed by the VuePilot software, this is done by comparing a remote hash with a hash of the newly downloaded software before conducting a rolling update to combat man in the middle style injection attacks.<\/p>\n The VuePilot service will never see your payment card information, nor does it ever store it or have the ability to access the full card details.\u00a0 Your payment card details are sent and stored directly and securely with the global payments provider Stripe<\/a><\/strong>.\u00a0 Stripe is responsible for handling all charges and payment information, VuePilot will simply store the customers unique customer ID and make requests to the Stripe API to perform various subscription related activities. The VuePilot “player” software establishes connections with the VuePilot API in a polling fashion over standard secure port 443 HTTPS connections which means no external firewall ports needs to opened in order for the software to function or remote management functionality to operate.<\/p>\n Connections are made to the domains if you require domain white listing<\/p>\n All of our databases and compute infrastructure are hosted hosted with our cloud provider Digital Ocean<\/strong> in California, United States Our infrastructure is protected by CloudFlare<\/strong><\/a> which also provides our Content Delivery Network. VuePilot provides a number of security mechanisms to help keep your data and machines secure. This article will outline some of the security controls implemented across the VuePilot platform and aims to clear up some confusion about how parts of the service work from a security perspective. Encrypted Communications All communications between the client and […]<\/p>\n","protected":false},"author":1,"featured_media":2721,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","article-category":[74],"article-tag":[],"class_list":["post-2720","article","type-article","status-publish","format-standard","has-post-thumbnail","hentry","article-category-security"],"yoast_head":"\nPassword Encryption<\/h3>\n
<\/h2>\n
Application Security<\/h2>\n
Two Factor Authentication By Default<\/h3>\n
Rotations, Pages & Apps<\/h3>\n
\nA rotation is essentially like a playlist, it will contain an ordering of pages and the timing for each.<\/p>\n
\nThe only information passed back and forwards between the client and server is JSON configuration data over secured HTTPS connections.\u00a0 Apps such as Power BI are only ever loaded locally by the VuePilot player.<\/p>\nLogging Into Websites & Dashboards<\/h3>\n
\nThe authentication information is stored locally, on that machine and it does not leave that machine.\u00a0 The VuePilot service will never see this authentication information nor is it able to outside of your local machine.<\/p>\nVuePilot Media Manager \/ Asset Storage<\/h3>\n
“Remote Management” Security<\/h3>\n
\nVuePilot will periodically send requests to the VuePilot API which listens for specific instructions from the API sent by users from the dashboard.\u00a0 These instructions are sent back and forwards to the API over standard HTTPS connections and only include JSON data, not visual information.<\/p>\n\n
\n
VuePilot Player Software<\/h3>\n
Payment Card Information<\/h3>\n
\nYou can read more about VuePilot subscriptions here https:\/\/www.vuepilot.com\/support\/article\/subscriptions-payments-billing<\/a>
\nYou can read more about Stripes security practices here https:\/\/stripe.com\/docs\/security<\/a><\/p>\nFirewall Requirements<\/h3>\n
\n
\n
Infrastructure Security<\/h2>\n
Cloud Hosting<\/h3>\n
\nYou can read more about Digital Oceans security policies here https:\/\/www.digitalocean.com\/security<\/a><\/p>\nContent Delivery Network (CDN), WAF (Web Application Firewall), DDOS Protection, Rate Limiting<\/h3>\n
\nCloudFlare provides a number of security features such as exploit detection, web application firewalls, rate limiting & DDOS protection.
\nYou can read more about CloudFlare security policies here https:\/\/www.cloudflare.com\/security<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"