Security

Player Software

The DST Connect app runs on 50+ hardware platforms via a unified JS SDK. The app is deployed as a native application per operating system.

Supported Platforms

Network Requirements

All communication between players, CMS, and APIs is secured and optimised for bandwidth efficiency.

Protocols & Ports

• All communication takes place over HTTPS (TLS 1.2 or higher) on port 443.
• We recommend also whitelisting port 80, as some external content may be loaded via HTTP.

Communication

• Both the player software and the CMS use multiple REST API endpoints.
• Content is delivered via a CDN with delta updates to reduce bandwidth usage and ensure fast refresh.

Device Pull Model & Scaling

• Players operate statelessly and periodically check for updates.
• Only modified content ("deltas") is downloaded, enabling efficient caching and reliable offline playback.

Whitelisted Domains

Ensure the following domains are whitelisted in your firewall and proxy configuration.

Core CMS & Content Hosting

Common External Content Domains

Security & Access

DST Connect implements multiple layers of security to protect your data and ensure compliance.

Authentication & Authorization

• Federated login via SAML / Microsoft Entra ID
• Role-Based Access Control (RBAC) with custom permissions
• IP whitelisting for administrative interfaces
• Multi-Factor Authentication (MFA) — optional, can be enforced per organisation by administrators

Session Management

• Automatic session expiry after a configurable period of inactivity
• Sessions are invalidated on password change or account deactivation
• Secure, HTTP-only session cookies with SameSite attribute

API Security

• Rate limiting on all API endpoints to prevent abuse
• API key authentication with rotation policies (frequency varies per key type)
• All API traffic over HTTPS exclusively

Encryption & Data Protection

• All communication over HTTPS (TLS 1.2+)
• Sensitive data stored with AES-256 encryption
• Passwords hashed using bcrypt with salt

Data Residency

• Default hosting in EU (Frankfurt, Germany)
• Customers can request EU-only data residency to guarantee all data remains within the European Union
• US hosting available for customers that prefer or require it

Compliance

• Fully GDPR and ISO 27001 aligned
• DST Connect acts solely as a data processor
• Upon contract termination, all data is securely and irreversibly deleted within 30 days
• Data Processing Agreement (DPA) available on request — contact security@dst-connect.io
• Cyber liability insurance in place covering data breaches and security incidents
• 99% uptime SLA for the cloud platform

Penetration Testing

DST Connect undergoes annual penetration tests conducted by independent, certified third-party security firms. These tests cover the full attack surface including web application security, API endpoints, authentication flows, and infrastructure.

• Frequency: annually (minimum), with additional tests after major platform changes
• Scope: OWASP Top 10, API security, authentication & authorization, infrastructure
• Remediation: all critical and high findings are resolved before the next release cycle
• Reports: penetration test reports are available upon request under NDA

Incident Response

DST Connect maintains a documented incident response procedure aligned with ISO 27001 guidelines:

• Detection & triage — automated monitoring and alerting for security events
• Notification — affected customers are notified within 72 hours of confirmed data breach, in accordance with GDPR Article 33
• Containment & remediation — immediate measures to contain the incident, followed by root cause analysis
• Post-incident review — lessons learned documented and preventive measures implemented

Vulnerability Management

• Dependencies are monitored for known vulnerabilities (CVEs) and patched regularly
• Infrastructure patches are applied within 30 days for critical vulnerabilities, 90 days for non-critical
• Code reviews are performed on all changes before deployment to production
• Responsible disclosure: security researchers can report vulnerabilities to security@dst-connect.io

Backup & Disaster Recovery

• Daily automated backups of all databases and file storage
• Backups are encrypted (AES-256) and stored in a geographically separate location within the EU
• Recovery Point Objective (RPO): 24 hours
• Recovery Time Objective (RTO): 4 hours
• Disaster recovery procedures are tested periodically

Business Continuity

DST Connect maintains a Business Continuity Plan (BCP) to ensure service availability during disruptions:

• Documented procedures for infrastructure failure, data centre outage, and key personnel unavailability
• Geo-redundant infrastructure with automatic failover
• Devices continue playback independently during cloud outages (offline resilience)
• BCP is reviewed and updated annually
• BCP documentation available on request — contact security@dst-connect.io

Audit Trail & Logging

• All user actions (login, content changes, device management commands) are logged with timestamp, user ID, and IP address
• Logs are retained for a minimum of 12 months
• Access to logs is restricted to authorised personnel only

Employee Security

• All employees sign confidentiality agreements
• Access to production systems follows the principle of least privilege
• Multi-factor authentication (MFA) required for all internal systems
• Regular security awareness training for all team members

Server Locations

Production infrastructure is hosted across certified data centres with full redundancy.

On-Premise Installations

While DST Connect is primarily cloud-hosted, on-premise deployment is available for customers requiring local hosting due to security, compliance, or offline needs.

Supported Operating Systems

• Debian / Ubuntu Server
• Red Hat Enterprise Linux (RHEL)
• CentOS Stream
• Other enterprise Linux distributions (subject to compatibility testing)

Containerized Deployment (Docker)

• On-premise requires a Docker-based installation.
• Delivered as one or more Docker containers for consistency and easy maintenance.
• Supported with Docker Compose or orchestration (e.g., Kubernetes) following provided guidelines.

Minimum Server Requirements

Example Hardware

A DELL EMC PowerEdge T150 provides a reliable foundation for on-premise hosting:

• Intel Xeon E-2300 series processor
• 8–16 GB ECC DDR4 RAM
• Enterprise-grade SSD storage
• Optional redundant PSU for higher availability

Network & Security Requirements

• Enable HTTPS (TLS 1.2+) for all CMS and API endpoints
• Open ports: 443 (required), 80 (optional for external content)
• Whitelist required core and integration domains (see Whitelisted Domains)
• Use internal DNS or static IP for stability

Responsibilities

• Provision and maintain server hardware or VM
• Apply OS patches and security updates
• Manage firewall and network configuration
• Perform backups per internal policy (procedures available on request)
• Ensure resources for high-availability/scaling if required

Support & Maintenance

• Installation guidelines, Docker configuration, and initial deployment assistance provided
• Pull ongoing application updates via Docker image updates (per change management)
• Optional remote support via secure VPN or jump-host

Sub-processors — Personal Data Processing

The following sub-processors process personal data as part of the DST Connect Data Processing Agreement (DPA). These are mandatory inclusions.

Sub-processors — End-User Data (Optional Modules)

These sub-processors process personal data of the customer's end-users. They apply only when the customer activates the corresponding module.

Sub-processors — Public Data Only

These services process only public or non-personal data and are likely not required as sub-processors under GDPR.