Security · mechanisms, not badges
The screen verifies what it is about to show.
Accounts, tenant data, device credentials, and signed releases each have a concrete boundary. We describe those controls without implying certifications we have not completed.
Your organization is a hard boundary
Every API request resolves its organization from your credential — never from a URL you can edit. Asking for another organization's data returns the same 404 as asking for something that doesn't exist, so existence itself is never leaked. An automated adversarial test suite (two organizations trying to read, guess, and mutate each other's resources) runs in CI on every change.
Credentials are stored as hashes only
Passwords are hashed with PBKDF2 and verified in constant time. API keys and device pairing secrets are stored as SHA-256 hashes — the readable key is shown once, at creation, and never again. Sessions live in expiring server-side records and can be revoked individually from Settings.
Screens verify what they show
Every screen feed is signed with Ed25519. Players hold only the public key and verify the signature before activating a release — a tampered or replayed manifest is rejected and the screen keeps showing its last known-good content. Pairing uses one-time 6-digit codes that expire in 10 minutes; revoking a screen returns it to the pairing screen within 90 seconds.
Your content stays yours — and portable
Export everything we hold for your organization (boards, menus, media manifest) from Settings, once per day. Deletion is a 14-day soft-delete followed by a hard delete across database, storage, and caches — verified by an automated lifecycle test. We never delete content over a failed payment.
Boring, auditable infrastructure
CanvasRelay runs on Cloudflare (Workers, D1, KV, R2) with infrastructure defined in version-controlled configuration. Billing is handled by Stripe — card numbers never touch our servers. The full API surface is published as an OpenAPI document, and every security-relevant action writes an audit event retained for one year.
No advertising trackers
We collect only the first-party analytics needed to run and improve the product (PostHog, explicit events only — no session replay). There are no third-party ad networks or cross-site trackers on CanvasRelay.
Found a vulnerability?
Please report it to [email protected]. We acknowledge reports within one business day, and we ask that you give us a reasonable window to fix the issue before public disclosure. We do not currently run a paid bug bounty.
A note on honesty: we are a young product and have not yet completed third-party audits or certifications (SOC 2, ISO 27001). Rather than imply otherwise, this page describes the concrete mechanisms in place today — every one of which is enforced and tested in the codebase. Data handling specifics are in our Privacy Policy.