How taleor keeps a venue safe.
Most of what follows happens on its own. You will not see it on a normal day. It is here so that your IT team, your security officer and anyone writing a tender can read exactly what taleor does and why.
Every connection is encrypted
Browsers, players and the console talk over TLS 1.3. Players go one step further. Each player creates its own key pair on its own machine and sends only the public half to the venue. The venue's own certificate authority signs it. The private key never leaves the machine. Certificates last 398 days and renew over the player's own connection in the final 30 days, so every player in the venue rotates without a site visit.
One authority per venue
Each venue has its own certificate authority. A problem at one venue cannot create an identity at another. When a player receives a new certificate, the old one is revoked, so a re-imaged player never shares an identity with the disk it replaced. Every connection is checked against the database: not revoked, not expired, still this device, still this venue.
Drivers are signed, updates are checked
A device driver is a small package with a manifest and a detached signature (Ed25519). The server refuses an unsigned package by default. Player updates come from one place. The server publishes a version with its SHA-256 checksum. The player verifies the checksum before it swaps directories, installs only outside opening hours, and goes back to the previous version if the new one fails its health check within ten minutes.
Five roles, one audit log
Network admin, estate admin, venue admin, content manager and facilities manager. Each role can do what its job needs and no more. A facilities manager can restart a frozen screen and cannot delete one. Every change is written to the audit log with the person, the action and the address. The log exports as CSV with the same filters you see on screen.
When a player drops off, you see which one
The alert tells you where the player is, what it should be showing, and since when. It clears itself when the player returns. A fault that repeats updates the existing alert instead of adding a new one, so the list stays readable.
One hold. Flash every screen.
The emergency hold reaches the whole venue, a floor, a zone or chosen players. The message takes the full screen, a notice runs along the bottom, and exhibit sound goes quiet. A player that reconnects during a broadcast still receives it. Who held it, and when, is in the log.
Visitors stay anonymous
Presence and touch events carry a venue, a device, a zone, a state and a time. They carry nothing that identifies a person: no address, no face, no cookie. An automated test checks this against the live database schema and fails the build if anyone adds such a column.
Your own server, with no internet if you choose
The local server installs its own private database with a random password that nobody ever types. Media, players and the audit log stay inside your building. No internet is needed at all. An outage anywhere else never reaches your galleries.
Read further
The data sheet lists every platform, protocol and control in the form tenders expect. The white paper explains why media, hardware and updates belong under one audited system.