Security
you can verify.
Edge-first processing, encrypted transport and storage, scoped API keys, and security controls aligned to the frameworks your procurement team works with. Here's exactly how it works.
Infrastructure
Built so the worst case can't happen.
The architecture removes most categories of risk by design. Where it can't, the operational controls catch the rest.
Edge-first architecture
Video is processed on the device next to the screen and discarded in milliseconds. Only anonymous aggregate metrics ever leave the hardware. No raw frames reach the cloud, period.
Encryption in transit
Every connection between edge devices, dashboard and API uses TLS 1.3. Certificates are managed and rotated automatically.
Encryption at rest
All stored data — analytics, configuration, backups — is encrypted with AES-256. Backups are encrypted independently and access-controlled.
Tenant isolation
Every organisation's data is logically isolated with row-level security policies in Postgres. API keys are scoped per-organisation and per-permission.
Data practices
Honest about what we touch.
The simplest privacy claim is the one you can defend in a room full of auditors. Here's the line — what we work with, and what the architecture won't let us do.
What we collect
- Anonymous audience counts (how many, not who)
- Dwell time grouped into bands (5s, 15s, 30s, 60s+)
- Attention events — when someone turns toward a screen
- Aggregate demographic patterns at zone level, sampled across ≥5 minute windows
- Zone-level audience flow and time-of-day trends
Aggregate demographic patterns mean zone-level distributions averaged over windows of five minutes or longer — never tied to a specific person or visit.
What we never do
- No faces stored or transmitted — no biometric templates ever
- No individual tracking or re-identification between visits
- No demographic inference at the individual level — only aggregate patterns over time
- No special category data (race, religion, political views, health, sexual orientation)
- No audio capture, conversations or personal identifiers
- No raw video retained or exported from the cloud
Compliance posture
The controls in operation today.
We don't lead with badges we don't have. Our architecture and controls align with the frameworks your procurement team works to — we'll be honest about where we are on formal certification.
ISO 27001
AlignedISMS mapped to ISO 27001 Annex A — access control, data classification, encryption, change management, incident response. We don't currently hold formal certification.
SOC 2
AlignedControls designed against the SOC 2 Trust Services Criteria. We don't hold formal attestation today — happy to talk procurement through what we operate.
GDPR & EU AI Act
Architectural fitAggregate-only audience analytics fall under the EU AI Act's Limited Risk tier. GDPR fit is enforced by the architecture, not just policy — DPA available on request.
Questions on our compliance posture? Email compliance@signiq.cloud — we'll walk you through the controls we operate today.
API security
Secure by default at every endpoint.
The day-to-day controls your integration team will actually touch — keys, limits, signing, logs.
Scoped API keys
Fine-grained permission scopes (read, write, analytics, export, webhooks). Keys are hashed with SHA-256 and never stored in plaintext — rotate or revoke at any time from the dashboard.
Rate limiting
Per-key sliding-window rate limits, sized to the API tier. Pro and Enterprise tiers come with higher ceilings and burst headroom.
Webhook signing
Every webhook delivery is signed with an HMAC-SHA256 secret. Verify the signature on your side to confirm the payload is authentic and untampered.
Audit logging
Subscription changes, key operations, exports and administrative actions are logged with timestamp, actor and IP. Logs are exportable on Pro and above.
Questions for the security team?
Responsible disclosure, security questionnaires, DPA reviews, architecture deep-dives — drop us a line. A human reads every note that lands.