Security and trust

Built to protect your screens, media and account data

This public report explains the security controls and high-level infrastructure model behind xazi. It is designed for customers, partners and procurement teams who need clear assurance without sensitive implementation detail.

Last reviewed: 16 July 2026

Accounts

Controlled access

Admin access is protected with password hashing, role-based permissions, CSRF protection, session timeouts and multi-factor authentication support.

Players

Authenticated devices

Players authenticate with API keys, device binding and approval workflows. API keys are hashed server-side and can be rotated.

Media

Safe content handling

Uploads are checked by type, validated by file signature, scanned asynchronously and stored behind authenticated API access.

Operations

Audit and recovery

Security events, admin audit logs, structured application logs and backup workflows help support monitoring, investigation and recovery.

Infrastructure Layout

A high-level view of how traffic, application services and storage are separated.

Customers Browser admins

Manage screens, media, schedules, users and billing.

Display estate Approved players

Sync schedules and download assigned media only.

Partners Managed clients

Operate separate customer accounts under partner controls.

TLS-secured traffic through the public edge

Web app Admin portal

Sessions, MFA, RBAC, CSRF protection and security headers.

API Player services

API-key authentication, rate limiting and tenant-scoped responses.

Realtime Push service

Signals connected players to refresh without exposing storage directly.

Private service network and authenticated service access

Database MySQL

Stores users, organisations, schedules, billing state and audit records.

Media store Uploads

Direct web access is blocked; files are served through authorised APIs.

Cache Redis

Private cache and rate-limit store protected on the service network.

Scanning AV quarantine

New media is scanned before it becomes available to players.

Resilience Backups

Database, app and media backup workflows support restore and continuity.

Security Controls

Area	How xazi protects it
Transport security	Production traffic is expected to run over HTTPS, with strict browser headers and HSTS support at the web layer.
Admin sessions	Sessions use HttpOnly cookies, SameSite controls, idle and absolute expiry, regeneration and server-side revocation.
Role separation	Platform, partner, client admin, content manager and viewer permissions are separated to support least-privilege access.
Player access	Players use authenticated sync and media APIs. Device approval, device binding and API-key rotation reduce misuse risk.
Tenant isolation	Media, schedules, players and reporting are scoped to the authenticated organisation or partner context.
Upload safety	File extensions, MIME type and magic bytes are validated. New uploads pass through scan/quarantine before publication.
Operational monitoring	Admin actions, security events, API usage and performance timings are logged for review and investigation.
Payment scope	Stripe handles payment card processing. xazi does not need to store card numbers or CVV values.

Compliance Direction

Cyber Essentials readiness

The platform is being aligned to practical Cyber Essentials controls: access control, secure configuration, malware protection, patching and firewall exposure.

OWASP-led web security

Application controls are built around common OWASP expectations including authentication, session management, CSRF protection, upload safety and tenant isolation.

GDPR-aware operation

Account data, logs and billing records are handled with access controls, retention planning and deletion processes as operational requirements.

Important note

This page is a public security overview, not an independent certification. Formal compliance claims require production evidence, vulnerability scans, policy records and, where required, third-party assessment.