VuePilot provides a number of security mechanisms to help keep your data and machines secure.
This article will outline some of the security controls implemented across the VuePilot platform and aims to clear up some confusion about how parts of the service work from a security perspective.
Encrypted Communications
All communications between the client and our servers performed over TLS / SSL encrypted communications. This includes the VuePilot software and communications with our APIs.
All communications between our internal services and our databases are also performed over encrypted connections.
Data Security
Encryption At Rest
Our databases are “encrypted at rest” by default using LUKS disk encryption.
Password Encryption
User passwords are never stored in the database. Passwords are hashed using a strong one way hashing algorithm and stored in an irreversible format. Authentication is performed by re-hashing new passwords and comparing to the stored hash.
Application Security
Two Factor Authentication By Default
Two factor authentication is enabled by default for all users unless specifically disabled. If we detect that a different device is attempting to access your account you will be emailed a security code which must be inputted into a form before you can continue to access the dashboard.
Rotations, Pages & Apps
The VuePilot software displays “Rotations” on the screens in your business, a rotation consists of “Pages”, a page can be either a regular website URL or an “App” which is a collection of configuration items with instructions on how to display the content such as positioning, sizing, layouts etc.
A rotation is essentially like a playlist, it will contain an ordering of pages and the timing for each.
The VuePilot player requests the “Rotation” from the API at regular intervals and uses this information to drive what is displayed on screen. The VuePilot player software will simply display what is configured to display within the rotation.
The only information passed back and forwards between the client and server is JSON configuration data over secured HTTPS connections. Apps such as Power BI are only ever loaded locally by the VuePilot player.
Logging Into Websites & Dashboards
When using private dashboards, websites or services like Power BI in your rotation is it neccessary to login to the website by using a method such as the “Rotations > Preview > Login” method outlined here Logging Into Websites That Require Authentication
It is important to note that this happens on the device connected to your screens running the VuePilot software and that the VuePilot software is running it’s own version of Chromium, hence you are logging into the website just like a normal browser.
The authentication information is stored locally, on that machine and it does not leave that machine. The VuePilot service will never see this authentication information nor is it able to outside of your local machine.
VuePilot Media Manager / Asset Storage
All assets stored in the VuePilot media manager are available publicly. All VuePilot media manager assets will have a unique public URL, specific to your account that makes it unlikely to be discovered (ie https://assets.vuepilot.com/uploads/3839/e8d-myimage.jpg) however you should never store any private or highly sensitive information within the media manager as it can be viewed by anyone with the direct link.
Customers may use their own internal company file storage solutions for sensitive information such as sales figures, internal processes, product data, charts etc. When using internal URLs to sensitive content only the URL is ever sent to our servers in order to sychonize what content is to be displayed across your devices. The actual content will never leave your internal network.
The VuePilot media manager is intended for usage with standard public web assets, promotional material, images, video, photos etc.
“Remote Management” Security
Customers often mistake this feature for a “Remote Desktop” product like VNC or Windows Remote Desktop. VuePilot does not provide remote desktop functionality or any type of functionality that would allow any individual to control the player machines operating system from a remote location.
VuePilot will periodically send requests to the VuePilot API which listens for specific instructions from the API sent by users from the dashboard. These instructions are sent back and forwards to the API over standard HTTPS connections and only include JSON data, not visual information.
VuePilot cannot see your desktop, nor can it provide functions such as mouse control or any form of manipulation of the operating system outside of the standard VuePilot uses. The “Remote Management” features are merely JSON requests being passed back and forwards between client and server with minimal information, such as “display URL: https://cnn.com“
Only a small set of remote management instructions can be sent between the client and server, these are to perform basic operation such as
-
- Start rotation
- Stop rotation
- Toggle fullscreen view
- Display URL (hijack)
- Display App (hijack)
- Reload local screen information
VuePilot Player Software
The VuePilot player software is updated often to apply security patches and the latest Chromium releases. It operates in a “context isolation” mode which isolates memory from the windows displaying content from the main application process to prevent malicious browser exploits.
Automatic updates are performed by the VuePilot software, this is done by comparing a remote hash with a hash of the newly downloaded software before conducting a rolling update to combat man in the middle style injection attacks.
Payment Card Information
The VuePilot service will never see your payment card information, nor does it ever store it or have the ability to access the full card details. Your payment card details are sent and stored directly and securely with the global payments provider Stripe. Stripe is responsible for handling all charges and payment information, VuePilot will simply store the customers unique customer ID and make requests to the Stripe API to perform various subscription related activities.
You can read more about VuePilot subscriptions here https://www.vuepilot.com/support/article/subscriptions-payments-billing
You can read more about Stripes security practices here https://stripe.com/docs/security
Firewall Requirements
The VuePilot “player” software establishes connections with the VuePilot API in a polling fashion over standard secure port 443 HTTPS connections which means no external firewall ports needs to opened in order for the software to function or remote management functionality to operate.
Connections are made to the domains if you require domain white listing
-
- www.vuepilot.com
- assets.vuepilot.com
- cmd.vuepilot.com
- vuepilot-data.sfo2.digitaloceanspaces.com (File uploads only)
Infrastructure Security
Cloud Hosting
All of our databases and compute infrastructure are hosted hosted with our cloud provider Digital Ocean in California, United States
You can read more about Digital Oceans security policies here https://www.digitalocean.com/security
Content Delivery Network (CDN), WAF (Web Application Firewall), DDOS Protection, Rate Limiting
Our infrastructure is protected by CloudFlare which also provides our Content Delivery Network.
CloudFlare provides a number of security features such as exploit detection, web application firewalls, rate limiting & DDOS protection.
You can read more about CloudFlare security policies here https://www.cloudflare.com/security