For IT teams
Somebody has asked you to run this
So here is what it is, what it touches, and what it will not quietly become in six months. Written for the person who has to say yes rather than the person who wants it.
What am I actually installing?
A PHP application and a database. Nothing else runs on the server. It sits behind your existing web server and needs no daemon, no message broker and no container runtime unless you want one.
What does it talk to?
Your screens, over HTTPS, on your network. Nothing else. No licence server, no analytics endpoint, no update check. It runs unchanged on a network with no route to the internet.
What ports does it need?
One — whatever your web server already listens on. A WebSocket is optional and improves alert latency from a few seconds to under one; without it the system falls back to polling, which is a supported path rather than a degraded one.
How much load is a screen?
One small request every five seconds for alerts and a heartbeat every thirty. Twenty-five screens is roughly five requests a second against endpoints that usually answer "nothing has changed".
How do screens authenticate?
An opaque bearer token issued at pairing, stored on the server only as a SHA-256 hash. A screen can read its own content and nothing else. Revoking it takes effect immediately.
What happens when I patch the server?
Screens keep playing from local storage and reconcile when it returns. A restart during the working day is not an outage anybody sees.
Can I put it behind SSO?
The panel uses session authentication and sits behind whatever your reverse proxy enforces. Talk to us about your specific setup before you buy rather than after.
What is the upgrade path?
Pull the new version, run the migrations, rebuild the caches. There is a script. Screens do not need touching — the players are version-tolerant and the server tells them what they need.
Operationally
What you get for running it
The things that decide whether a system is a pleasure or a liability two years in.
Visibility
- A health page covering database, cache, storage, queue, scheduler and broadcaster
- Per-screen uptime history
- A delivery report per alert, per screen
Nothing dangerous exposed
- No operating-system commands from the panel
- Configuration outside the web root
- Rate limits on every public endpoint
Attributable
- Every publish, command and setting change is logged against a person
- Five roles, gated on permissions rather than role names
- Audit records live in your database
Send the questionnaire
We would rather answer your security review properly before anyone buys than discover a blocker afterwards.
No open demo, no sign-up wall — a person reads every request.