Hosting and Security

Fusion Signage is a cloud-based service hosted by AWS in Sydney (ap-southeast-2) region. We are deployed in multiple availability zones for high availability. All media files are stored in AWS S3 in the same region. No customer data is stored outside Australia.

Documentation on AWS compliance can be found at https://aws.amazon.com/compliance/programs/.

All data is encrypted at rest using AES-256 encryption.

Fusion Signage web endpoints are served over HTTPS. Our content management system uses TLS 1.3. Screen endpoints support both TLS 1.1 and 1.2 to ensure backwards compatibility for older devices.

Fusion Signage’s database is backed up every 5 minutes and can be restored to that point in time in the event of database corruption or loss of data. We keep 30 days of backups.

We use infrastructure as code to build our cloud infrastructure to ensure we can recreate our services consistently in the event of a major disaster.

All Fusion Signage online services are behind a web application firewall which proactively blocks detected threats or bad actors.

Access and application logs are kept for 90 days.

Fusion Signage engineers deploy new code to production several times a day and follow a Secure Development Lifecycle methodology. New features must pass a design review which includes threat modelling before development commences.

New code must pass a code review before it can be merged to our codebase. The code review includes automated tests and security checks which must pass before the code can be merged.

We use CI/CD pipelines to ensure consistent and safe code deployments.

Fusion Signage code is scanned by Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tooling on every commit to source control. These scans must pass before code can be merged.

Third-party libraries are kept up to date by an automated process that submit code reviews daily to upgrade libraries if a new version is released or if a vulnerability is discovered.

All code is deployed to a testing environment that is isolated from production to provide a space for safe manual testing of new code and features.

Fusion Signage welcomes disclosures of vulnerabilities. Please review our Vulnerability Disclosure Policy for more information.