Most signage vendors answer a security question with a badge. We cannot, because we hold none. What we can do is tell you who we are, where the data sits, how the screens connect, and what we do not have, so you can decide in ten minutes rather than in a three-week procurement loop. If the honest answer on this page rules us out, it is better that you find that out now.
Who we are, and which law we answer to
easyCMS is a product of DynamicDigital sp. z o.o., a limited company registered in Warsaw, Poland. Our EU VAT number is PL5213678094. We have traded in digital signage since 2014 and launched easyCMS in 2016.
That matters for three practical reasons.
- Jurisdiction. We are established in the European Union, so the GDPR applies to us directly. There is no US parent in the ownership chain, and the CMS that holds your content and your screen list runs on a server in the EU. The two places data touches a US-headquartered provider are website hosting and payments, and both are named in the table below.
- Invoicing. We invoice in euro and issue a VAT invoice carrying our Polish VAT number, handled under normal EU VAT rules. Your finance team gets a document it already knows how to process.
- Time of day. Support is answered by people in Central European Time, Monday to Friday, 09:00 to 17:00 CET. If your IT team, your finance office and your data protection officer all work European hours, so do we.
You can reach us at info@myeasycms.com or +48 509 937 137. Company details are on the about page.
Where your data lives
Three components hold anything, and here is all three.
| Component | What it holds | Where it runs |
|---|---|---|
| The easyCMS CMS | Your media, layouts, schedules, display records, account login | A server in the European Union, at Hetzner in Falkenstein, Germany |
| This website | The pages you are reading, plus contact and support form traffic | Firebase Hosting |
| Payments | Card and billing data for your order | Stripe |
The signage system itself, the part that holds your content and your screen list, runs on one server inside the EU. Nothing about your layouts, your media library or your display estate needs to leave the bloc for the product to work.
This site uses analytics cookies with your consent, and publishes a cookie policy that says what they are.
Good to know We do not publish a backup schedule, a retention period, an encryption algorithm or a sub-processor list on this page, because writing a number here that we have not committed to contractually would be worse than saying nothing. If you need any of those in writing, email info@myeasycms.com and ask. You will get an answer from a person, not a portal.
How the players connect, and why that design is the safe one
This is the part most IT departments actually care about, and it is the part where signage gets a bad name. Some systems want an inbound port opened to every screen. easyCMS does not.
- Players pull, they never listen. Each screen connects outward to the CMS on a schedule, asks what it should be showing, and downloads it. Nothing listens on the screen and nothing connects inward to it, so there is no inbound port to open on your firewall and no service on the display for someone on your network to knock on.
- The traffic is encrypted. Player to CMS communication runs over an encrypted connection.
- Every display is authorised first. A newly installed player registers itself and then sits there showing nothing. Until someone signs in to the CMS and authorises that display, it receives no content, no schedule and no media. An unauthorised device on your network cannot help itself to your content.
- Content is cached locally. Because the player holds what it needs, a network outage does not blank the screens. It stops updates, which is a very different failure.
The practical effect is that a screen on your network behaves like a workstation browsing the web, not like a server. Your firewall rules stay outbound only. The specific hosts and ports are on network requirements, which is the page to send to whoever runs your network before installation rather than after it.
Tip Put signage players on the guest or IoT VLAN if you have one. Outbound-only players work perfectly there, and it removes the screens from any conversation about lateral movement inside your main network.
What personal data signage does and does not touch
Signage is often waved through a data protection review because “it is just a notice board”. Sometimes that is right. Often it is not, and it depends entirely on what you put on the screen. What follows is general guidance from a signage vendor, not legal advice, and your own data protection officer or lawyer has the final word.
| What is on the screen | Personal data? | What that means for you |
|---|---|---|
| Corridor notices, menus, opening hours, weather, KPIs from a spreadsheet | Normally none | Low effort. Keep a note of why you concluded that |
| Visitor welcome screen naming today’s guests | Yes: names, often employer and host | Short display window, no logging of the list, and tell visitors at sign-in |
| Staff photo board, new starters, employee of the month | Yes: images of identifiable people | Get consent, and honour a withdrawal quickly, which means someone must own removals |
| Queue, ticket or appointment displays | Yes if it shows names or anything reidentifiable | Prefer initials or a ticket number over a full name |
| Camera-based audience measurement bolted on alongside signage | Yes, and this is the highest-risk category | Expect a full assessment, a lawful basis and clear signage about the camera |
Two things internal to the system are worth a moment of thought as well.
Display monitoring screenshots. The CMS can take an on-demand screenshot of what a given screen is playing. That is useful when a screen looks wrong and you are three floors away, but if the screen is showing a visitor list or a staff photo board, the screenshot contains that too. Decide who is allowed to take one.
Proof-of-play logs, on PRO and Enterprise, record which content played on which screen and when. They are about screens and content, not about viewers, and they contain no audience data. They are still records, so decide how long you keep them.
Our GDPR checklist for digital signage walks the whole thing through, including the questions a reviewer will ask you.
Access control, told straight
Here is the unflattering part, and we would rather you read it here than discover it in week two.
On the standard easyCMS account and on PRO, there is one login, and everyone who publishes shares it. There are no separate user accounts, no per-user roles and no permission scoping. If three people in your organisation update screens, all three use the same credentials, and nothing in the system tells one of them apart from another.
Per-user accounts, user groups, roles and permissions are an Enterprise feature. So is white label on your own domain, and Enterprise is the only recurring plan we sell, at 1290€ per year.
| If you need | The right plan |
|---|---|
| One or two trusted people publishing to a handful of screens | Account at 49€ or PRO at 299€, one shared login |
| Separation of duties, per-site or per-department scoping, named individual logins instead of one shared password | Enterprise at 1290 EUR per year |
If your security policy requires named individual accounts, and many do, the honest reading is that the one-time plans do not meet it and Enterprise is the only version of easyCMS that does. Do not buy the 49€ account expecting to add users to it later. More detail is in users and permissions.
We also do not offer single sign-on or multi-factor authentication on any plan. Accounts are password protected and that is the whole of it. Choose a strong, unique password and store it in your password manager, not in a shared spreadsheet.
Your data is yours, and the engine outlives us
Two questions come up in every serious evaluation. What happens to our content if we leave, and what happens to it if you disappear.
Your media, layouts and schedules can be exported. They are files and structured records, not a proprietary black box you can only ever look at through our interface.
The deeper answer is the engine. easyCMS is built on Xibo 4.5, an open-source signage engine published under the AGPLv3. We say so on this site and in the footer of every page, because it is a strength and not something to hide. The AGPLv3 means the source of that engine is public, auditable by anyone with the skills to read it, and cannot be withdrawn. Your players speak the same open protocol as any Xibo player, and its implementation is public source.
A subscription platform cannot give you that answer. If a closed SaaS vendor is acquired, changes direction or shuts down, the software goes with it and your screens become panels. With easyCMS the CMS you are using is a hosted, supported build of software that exists independently of us, has its own community and its own release history, and will still exist if we do not. That is a weaker promise than an escrow agreement and a stronger one than a status page, and it is the honest shape of the continuity argument. See managed Xibo hosting for how the hosted and self-hosted routes compare.
What we do not have
The most important section on this page. All of the following are things easyCMS does not have, and we will not imply otherwise in a sales conversation:
- No SOC 2 report, of any type
- No ISO 27001 certification
- No TX-RAMP authorisation and no HIPAA attestation
- No certification of any kind, from anyone
- No published uptime SLA and no service credits
- No public status page
- No SSO or SAML, and no multi-factor authentication
- No bug bounty programme
- No published penetration test report
- No audit log product on any plan, and no activity trail that records who changed what
If your tender, your insurer or your security questionnaire requires any of those, we are not the right supplier for you, and saying so on a public page saves both of us a month. Vendors who publish a formal SLA and a certification programme exist, they charge a subscription per screen per year to fund that work, and for some organisations that is exactly the right trade. Ours is the other trade: EU jurisdiction, EU hosting, open auditable code, a one-time price on every plan but Enterprise, and no paperwork we have not actually done.
What we publish, and what we do not
| Question | Our answer |
|---|---|
| Where is the CMS hosted? | Published: EU, Hetzner, Falkenstein, Germany |
| Who is the contracting entity? | Published: DynamicDigital sp. z o.o., Warsaw, Poland, VAT PL5213678094 |
| How do players connect? | Published: encrypted, outbound only, authorised per display |
| Privacy, cookies and terms | Published on this site |
| Data Processing Agreement | Not published. Email info@myeasycms.com |
| Retention periods and sub-processor list | Not published. Email info@myeasycms.com |
| Backup schedule and encryption detail | Not published. Email info@myeasycms.com |
| Uptime SLA, status page, penetration test | Do not exist |
| SOC 2, ISO 27001, HIPAA, TX-RAMP | Do not exist |
Asking for a DPA or a specific security answer
Email info@myeasycms.com with the question, or the questionnaire, and tell us your deadline. A Data Processing Agreement and questions about specific GDPR obligations are handled that way, by people rather than by a document library. If it is easier, use the support request form or call +48 509 937 137 during CET office hours. How support works, and what is free against what is paid, is set out in getting help and support options.
Our published policies are the privacy policy, the cookie policy and the terms and conditions. Pricing for every plan mentioned above, including what Enterprise adds, is on the pricing page.