Trust center
TVpilot runs the screens in your shop, lobby or office, so reliability and data protection are part of the product. This page lists what we do, where your data lives and who our sub-processors are, written to answer a security questionnaire before you send one.
Database, media and backups live in European Union data centres. Content is delivered through an edge network, but it is stored in the EU.
TLS 1.2 or higher on every connection, including player and device traffic. Databases and storage are encrypted at rest.
Every user can enable an authenticator app. On the Pro and Business plans, owners can require it for the whole team under Team, with the setting Require two-factor authentication.
Every row in the database carries its account id and is protected by row-level security policies, enforced by the database itself, not only by the application.
Owner, admin, editor and viewer roles; users can be limited to specific locations. Changes to playlists can require approval by a second person.
Logins, invitations, role changes, playlist publications and device actions are recorded per account and visible to the owners under Team.
Automatic daily database backups with point-in-time recovery. Deleted media stays in the trash for 30 days before it is removed.
Screens are paired with single-use claim codes and hold their own credentials, revocable from the dashboard. Players only pull content over HTTPS; nothing connects into your network.
Card and bank details never reach TVpilot servers; they go straight to a PCI DSS Level 1 certified payment provider.
TVpilot processes personal data as a processor for its customers under the GDPR. Data subject requests are handled within 30 days; accounts can be deleted by the owner at any time.
A standard DPA with the sub-processor list below is available for every plan. Email support@tvpilot.app and it is returned signed within two working days.
Our hosting, database and payment providers are SOC 2 Type 2 attested and ISO 27001 certified. TVpilot itself holds no certificate yet; this page and the DPA are our current evidence.
In the product: you can see it in your own account. Via our providers: held by the companies that host TVpilot. On request: a document we send you.
Sub-processors
TVpilot uses a small number of providers. Each one processes only what its role needs, under a written agreement. The data processing agreement names them; we announce a new sub-processor by e-mail at least 30 days before it goes live.
For your procurement team
In the European Union, with the application running in the same EU region as the database. Cached copies of public content can be served from the edge location closest to a screen, which is how a screen keeps playing when a region is slow.
Platform administrators can open an account for support, and every such action is recorded in the account activity log with the administrator's name. Nobody else has access.
Yes. An owner can delete the account under Settings; media, playlists, screens and users are removed and the stored files are deleted. Backups roll off within 30 days.
Available for Business customers on request. By default accounts use e-mail and password with optional two-factor authentication, and owners can make two-factor mandatory for their team (Pro and Business). To set up single sign-on, email support@tvpilot.app.
Screens keep playing. Every player caches its playlist and media locally and reconnects by itself; the Raspberry Pi and Amazon Signage Stick players also recover from power cuts without anyone on site.
We investigate on the day, fix first and inform affected customers by e-mail without undue delay, within 72 hours where personal data is involved, as the GDPR requires.
Yes. Send it to support@tvpilot.app; most questionnaires are returned within five working days. This page and the DPA answer the usual questions in advance.
TVpilot runs automated dependency and vulnerability checks on every release and keeps a responsible disclosure programme. We do not hold a SOC 2 or ISO 27001 certificate ourselves yet; our providers do. If a certificate is a hard requirement for your organisation, let us know: that demand is what decides when we start the audit.
Found a vulnerability? Report it to support@tvpilot.app. We respond within two working days, take no legal action against good-faith research, and credit reporters when a fix ships.
See also the privacy policy, the terms of service and account deletion.