Built so you don't have to trust us with much
XiPlay asks organizations to run our software on their hardware, some on networks that never touch the internet. The architecture is designed around that trust: signed licensing, minimal data, and no access to your content.
The core design decision: XiPlay's platform handles licensing and fleet management only. Your content lives in your own Xibo® CMS and travels directly to your players. Our servers are not in that path, can't read it, and don't store it. What remains on our side is deliberately small, and this page describes exactly what it is.
Licensing integrity
Signed verdicts (Ed25519)
Every license decision is cryptographically signed. Players verify signatures against XiPlay's published public keys, so a verdict can't be forged, altered or replayed onto another device.
Hardware-anchored identity
Licenses are keyed to each player's real hardware MAC address, so a license can't drift to unauthorized hardware, and your license audit is a list of MACs.
Authenticated device API
Connected players authenticate every licensing call with per-device credentials, with replay protection and rate limiting on the device-facing API.
Air-gapped by design
Offline license files are verified entirely on-device, so secure networks get real licensing with no phone-home. How air-gapped licensing works
What data we handle, and what we don't
| Your content | Never touches XiPlay. Layouts, media and schedules flow directly between your players and your own Xibo® CMS. We have no access to them and no copy of them. |
| Device data | What licensing needs: the player's hardware MAC, model, licensing state, and (for connected devices) check-in metadata such as IP and last-seen. |
| Account data | Your name, work email, organization and team membership: what the portal needs to operate your fleet. |
| Payment data | Handled by Stripe. Checkout and card entry happen on Stripe's PCI-DSS-compliant infrastructure; card numbers never reach XiPlay's servers. |
Details and rights: Privacy Policy.
Account & portal security
- ✓Argon2 password hashing, the current best-practice algorithm
- ✓TOTP two-factor authentication on every account
- ✓httpOnly session cookies, so tokens are never exposed to page scripts
- ✓Role-based team access, down to per-site management
- ✓Back-office actions recorded in an append-only audit log
- ✓All traffic over HTTPS
Security questions
Can XiPlay see what's on our screens?
No. XiPlay is a licensing and fleet platform. Your content is managed in and served from your own Xibo® CMS, and it never passes through XiPlay's infrastructure. On air-gapped deployments there isn't even a network path for it to.
What happens to our screens if XiPlay the company disappeared?
They keep playing. Players cache content and honor their last license verdict; issued offline license files remain valid for their full term with no callback needed. Activation was deliberately designed so screens don't depend on our cloud staying up, or existing.
How are licenses protected against tampering?
Every license decision, online verdicts and offline .lic files alike, is signed with Ed25519 (EdDSA). Players verify the signature against XiPlay's published public keys, so a license can't be forged or altered without invalidating it. Signing keys support rotation.
How is the customer portal protected?
Passwords are hashed with Argon2, TOTP two-factor authentication is available on every account, sessions use httpOnly cookies, and team access is role-based so members only see what their role allows.
How do I report a security issue?
Contact us through the demo/contact form and mark the message as a security report; it reaches the engineering team directly and we'll respond promptly. We ask for reasonable disclosure time to ship a fix.
Security questions we didn't answer?
Procurement questionnaires welcome. Talk to the team that built the licensing engine.