# Wallboard Digital Signage Platform Overview Wallboard is an enterprise-grade digital signage content management system (CMS) that empowers organizations to create, manage, and deploy dynamic content across screens with ease. Founded in 2012, Wallboard’s mission has been to provide the **world’s best digital signage platform** for businesses of all sizes. The platform is **no-code and user-friendly**, allowing marketing teams to design engaging content without coding, while offering IT teams robust control, scalability, and security. It is used across a wide range of industries to **engage audiences, streamline communication, and deliver real-time information** wherever it’s needed. ## Key Features and Capabilities - **Drag-and-Drop Content Designer:** Wallboard includes a **free-form content editor** with a blank canvas interface, supporting **20+ widgets**, layered design elements, and animations for rich, interactive content creation. The editor’s capabilities rival familiar design tools (akin to Photoshop or Canva) but are built specifically for digital signage. Users can start from scratch or utilize pre-built components to craft visually compelling signage. - **Extensive Template Library & Custom Apps:** To jump-start projects, Wallboard provides an **extensive library of templates** (200+ and growing) for various use cases. These professionally designed templates can be quickly customized with your branding and information, **no design skills required**. Wallboard 2.0 also introduced **Custom Apps** – ready-made interactive content modules (for kiosks, menus, meeting boards, etc.) that users can configure like templates, reducing creation time. - **Interactive & Data-Driven Content:** Wallboard enables building **interactive experiences** (e.g. touch-screen content) without writing code. Users can bind live data from sources like **Google Sheets, databases, RSS feeds, POS systems, IoT sensors, social media**, and more, allowing content to update automatically. - **Quick Editor for Instant Updates:** A lightweight editing mode that lets authorized users make fast edits to existing content. Ideal for urgent messages or time-sensitive changes. - **Scheduling with Playlists & Channels:** Use **Playlists** to sequence content and **Channels** to schedule rule-based playback across devices. Define "when", "what", and "where" content should play — ideal for managing content at scale. - **Device Management & Monitoring:** A centralized dashboard for managing player devices. Includes health status monitoring, remote updates, bulk actions, and device grouping/tagging. - **Proof-of-Play Analytics:** Built-in visual reports track playback metrics and device uptime. Filter, export, and analyze content performance across campaigns. - **Multi-User Collaboration and Permissions:** Granular **role-based access control** and **team management** allow organizations to delegate control safely and effectively. - **Integrations and Extensibility:** Supports external data sources, APIs, POS systems, dashboards, IoT triggers, and more. - **Enterprise Security & Reliability:** Offers cloud and on-premise options, encrypted communications, and strict access control. Built to meet enterprise data protection and operational standards. ## Supported Platforms and Hardware - **Operating Systems:** Windows, Android, Browser Client, JsCore. - **Signage Devices:** BrightSign, LG webOS, Samsung Tizen, Philips, Sony SoC displays. - **ePaper Displays:** Philips Tableaux, Sharp/NEC ePaper (via screenshot refresh mode). - Wallboard supports mixed-hardware environments and centralized management for all. ## Typical Usage Scenarios - **Corporate Communications:** KPI dashboards, event calendars, internal news, welcome screens. - **Education:** Campus-wide alerts, lunch menus, emergency notifications (CAP support), digital bulletin boards. - **Retail & QSR:** Digital menu boards, interactive kiosks, dynamic promos tied to inventory. - **Healthcare & Hospitality:** Waiting room info, schedules, lobby signage, wellness content. - **Government/Public Sector:** Alerts, announcements, public information, wayfinding, multilingual content. ## Platform UI and Workflow - **Dashboard:** Web-based interface organized into modules (Content, Playlists, Channels, Devices, Analytics). - **Content Creation:** Drag-and-drop editor with widgets and animation. Templates available. Slides → Playlists → Channels. - **Scheduling:** Rule-based scheduling via Channels. Real-time publishing. - **Device Management:** List/map/grid views. Bulk actions. Status visibility. - **User Management:** Roles, Teams, UI profiles, scoped access. - **Training & Support Aids:** Tutorials, tooltips, preview modes, knowledge base, support links. ## Deployment Options and Company Support - **Deployment Modes:** Cloud-hosted (multi-tenant), Private Cloud, Fully On-Premise. - **Company Info:** Headquartered in Texas, USA. Global team. Active development since 2012. - **Support:** Email-based regional support, training resources, partner portal, certified reseller program. - **Partnerships:** BrightSign, Philips/PPDS, and others for hardware-software integration. - **Target Customers:** SMBs to enterprises, across education, retail, government, and corporate environments. Wallboard is a flexible and powerful digital signage CMS built for scale, security, and ease of use. Its no-code design, data-driven capabilities, and broad device support make it suitable for organizations seeking dynamic, centrally managed content delivery. # Wallboard – Security Overview (Version 2.1+) Wallboard is a digital signage platform built for enterprise environments, offering flexible deployment models, integration with corporate IT systems, and robust security practices. --- ## 🔐 Authentication & Access Control - **OAuth 2.0** with PKCE authorization code flow (frontend) and client_secret flow (backend integrations). - **SAML 2.0** native implementation with per-tenant IdP configuration, encrypted assertions, replay protection. - **OpenID Connect** for Google/Microsoft login (existing accounts). - **Magic Code** passwordless email OTP login. - **Multi-Factor Authentication (MFA):** TOTP-based, three-level enforcement (system, tenant, user). Required for all login methods when enabled. - **Hierarchical RBAC:** Super Administrator → Administrator → Technical Manager → Content Manager → Content Editor → View Only → Device User. - **Team-based access model:** Users and resources assigned to teams. Access granted on team overlap. - **UI Profiles:** Define visible UI elements per role or user group. - **Privileged Access Controls:** Trusted vs Non-Trusted admin distinction. Non-trusted admins require TOTP re-auth for 30-minute write sessions. - **Account lockout** and **reCAPTCHA** (hybrid v2+v3) protection. - **Device fingerprinting** with token binding for session theft protection. --- ## 🔒 Data Protection - **In Transit:** TLS 1.2+ enforced. Cipher suites: ECDHE-ECDSA/RSA-AES128/256-GCM-SHA256/384, CHACHA20-POLY1305. Forward secrecy enabled. - **At Rest:** AES-256 encryption via infrastructure/storage provider (managed databases, encrypted block volumes). - **Internal Communication:** mTLS between pods via service mesh (Linkerd) in SaaS deployments. - **Passwords:** bcrypt-hashed with per-password salt. Plaintext never stored or logged. --- ## ☁️ Deployment Models (Version 2.1+) Kubernetes-first architecture deployed via Helm charts. Five deployment models: | Model | Description | Updates | Backup | |-------|-------------|---------|--------| | **Self-Managed** | Customer’s own K8s cluster | Manual | Customer choice | | **On-Prem Limited** | Single-node k3s/microk8s | Manual helm upgrade | Helm CronJobs + VM snapshots | | **Managed GitOps** | Single-node with ArgoCD | Automatic | Helm CronJobs + VM snapshots | | **WB SaaS** | Fully managed (DigitalOcean) | Automatic | WB responsibility | | **Air-Gapped** | Fully offline, pre-downloaded | Manual offline | Helm CronJobs + VM snapshots | Multi-tenant isolation options (SaaS): Shared cluster (default), Isolated namespace, Dedicated cluster. --- ## 🔁 Backup & Disaster Recovery - **Managed databases:** Cloud provider handles backups, retention, point-in-time recovery. - **In-cluster databases:** WB-developed backup containers (Helm CronJob → database dump → rsnapshot → PersistentVolume). - **SaaS:** Disaster recovery is Wallboard responsibility. - **On-prem:** VM/host snapshots are customer responsibility. --- ## 📊 Monitoring & Alerting - **Self-hosted observability stack:** Mimir (metrics), Loki (logs), Grafana Alloy (collector), Alertmanager, Grafana (dashboards). - **Alerting channels:** Email, Slack, webhooks. - **Audit logging:** TimescaleDB audit table (per-tenant). Security events (login, password, MFA) tracked. - **Log forwarding:** Private/on-prem customers can implement via Filebeat, Fluent Bit, syslog+TLS. --- ## ⚙️ Secure Development Practices - CI/CD pipelines (Jenkins, GitHub Actions) with automated unit and integration testing. - GitHub-based code review with branch protection and mandatory PR reviews. - GitHub Dependabot for automated dependency vulnerability detection and updates. - GitHub static code analysis and AI-assisted code review. - OWASP Secure Coding Practices adherence. --- ## 🧾 Compliance & Governance - **SOC 2 Type II:** Examination completed and final independent report issued. Report available to customers under NDA; controls remain under continuous monitoring through Sprinto. - **Penetration Testing:** Annual by independent third-party firms. Reports available under NDA. - **GDPR:** Minimal personal data processing, per-tenant isolation, EU data residency for EU customers. - **Data Residency:** Regional deployments (US, EU). EU customer data never leaves EU/EEA. - **Frameworks alignment:** ISO 27001, NIST Cybersecurity Framework, OWASP ASVS. --- ## 🧩 Tenant Isolation Models - **Multi-tenant cloud:** Shared infrastructure and databases with strict logical isolation at application layer (`customerId` filtering). - **Isolated namespace:** Dedicated namespace within shared cluster with separate pods, services, and persistent volumes. - **Dedicated cluster:** Full cluster isolation including compute, storage, databases, and network layer. - **On-premise:** Complete physical separation under customer control. No hybrid model where data is partially split between customer and vendor infrastructure. Customers requiring strict separation must use either a dedicated cluster, private cloud, or on-premises deployment.