Wayfinding security and trust: what we can show you, and what we don’t have yet.
DigiMaps holds no security or accessibility certifications yet. There is no SOC 2 report, no ISO 27001 certificate and no independent penetration test. What we can show you is evidence: how visitor data stays anonymous, how releases are controlled, how the on-premises edition stays offline, and the tests behind each claim.
Last updated
06 We can show you
- Anonymous visitors: no accounts, no sign-in, a fresh session for each one
- Personal data scrubbed on the device and again on the server
- Staff-only rooms removed from every public screen at publish
- Reviewed, reversible releases and an append-only audit log
- An on-premises server with no outbound calls by default
- Static analysis, dependency and secret scanning on every change, plus scheduled API scans
05 Not yet
- SOC 2 report, Type I or II
- ISO 27001 certificate
- Independent penetration test
- Third-party accessibility audit or VPAT
- Uptime SLA or public status page
Every claim, what backs it, and how to check it.
These are the security and privacy claims we make on this site. For each one: the mechanism in the product, and where you can see it working, in a demo or in a document.
-
01 Visitors stay anonymous
What backs it Kiosks have no login and no personal-data forms. Each visitor reset starts a new anonymous session. The occupancy feed accepts no device MAC addresses.
How to see it Watch a kiosk reset itself in the demo, then open the statistics export.
-
02 Typed personal data is scrubbed
What backs it E-mail addresses, ID-format numbers, phone numbers and long digit runs are replaced on the device and again on the server. Hospital and government packs drop typed search text entirely.
How to see it Type a phone number into search in the demo, then read the event log.
-
03 Small groups are hidden in statistics
What backs it k-anonymity suppression: by default, any figure from a group smaller than 5 is not shown.
How to see it Statistics settings in Studio, during the demo.
-
04 Old analytics are deleted
What backs it Retention defaults to 395 days and can be set from 1 to 3,650 days per venue, through the API today. Older events are purged automatically.
How to see it The retention setting and purge endpoint in the API reference.
-
05 Staff-only rooms never reach a public screen
What backs it Visibility is decided on the server at publish. Staff-only and hidden rooms are left out of search, the directory, directions, landmarks, notices, public feeds, deep links and QR codes.
How to see it Publish a test venue with a staff-only room, then search for it on a kiosk.
-
06 Every change is attributable
What backs it The audit trail records sign-ins, failures, refusals and live-content changes. The database rejects any update or deletion of audit rows. Sign-in is throttled after 5 failures in 15 minutes.
How to see it The audit page in Studio, during the demo.
-
07 Map changes are reviewed and reversible
What backs it Changes can be sent for review and approved or rejected before they publish. Visitors only ever see an immutable published release, and rollback re-publishes an earlier one.
How to see it Draft, review, publish and roll back during the demo.
-
08 Production refuses unsafe settings
What backs it The API will not start in production with debug on, a weak signing secret, wildcard CORS, rate limits off or API docs exposed.
How to see it The configuration checks and their tests, under NDA.
-
09 Integrations are authenticated
What backs it Webhooks are signed with HMAC-SHA256. Kiosk device tokens and partner API keys are stored only as hashes, and the full key is shown once.
How to see it The developer documentation. API keys and signed webhooks
-
10 The on-premises server sends nothing out by default
What backs it AI features are off, fonts are bundled, and there is no telemetry or update check. Our build compiles the Wayfinder with networking disabled and scans it for third-party URLs.
How to see it Run the egress check against your own server at commissioning. Running DigiMaps on your own server
-
11 Accessibility is tested automatically, not audited
What backs it Designed to support WCAG 2.1 AA, with automated accessibility checks in our build pipeline. Tests hold the kiosk’s high-contrast mode to 7:1 on every text pair, and touch targets to 56 px.
How to see it Switch on high contrast and reach mode in the demo. Accessible wayfinding in detail
What we don’t have yet.
Procurement teams ask about these first. When one changes, this list changes, with the date at the top of the page.
| Item | Status | What it means |
|---|---|---|
| SOC 2, Type I or II | Not held | No report of either type, and we do not describe one as in progress. Ask us for the current status. |
| ISO 27001 | Not held | DigiMaps has no ISO 27001 certificate. |
| Independent penetration test | Not done | No independent penetration test has been carried out yet. The test scope is written and available under NDA. |
| Accessibility audit or VPAT | Not done | No third-party audit, so we claim no conformance and have no VPAT to send. |
| Uptime SLA | None | No SLA and no public status page. Health monitoring, kiosk offline alerts and monthly kiosk uptime reports are built in. |
| HIPAA, PCI DSS | Not held | DigiMaps has no patient-record or card-payment features for visitors. |
| PDPL, DPDP or Dubai ISR attestation | None | A UAE control mapping is ready for your legal team. For India’s DPDP Act and Saudi PDPL, we work through your requirements with you. |
| Cloud region pinning | Not in the product | Nothing in DigiMaps enforces a cloud region. The region is the one your contract names. |
Security engineering, described as practice.
Every change goes through static analysis, dependency and secret scanning, and scheduled OWASP ZAP API scans. This page lists what runs, not a result. Ask to see the latest run, open findings included.
- 01 Static analysis Bandit, and Semgrep’s OWASP Top 10 rules Every change
- 02 Dependency audit pip-audit for the API, npm audit for Studio, Wayfinder and the SDK Every change
- 03 Secret scanning detect-secrets across the repository Every change
- 04 Architecture tests A tenant check on every route, tenant-isolation and auth-coverage tests Every change
- 05 API scan OWASP ZAP against the published OpenAPI spec Weekly
- Sign-in
- 60-minute access tokens, 7-day revocable refresh tokens, bcrypt passwords, six roles with per-venue access
- Single sign-on
- Enterprise SSO via SAML 2.0 and OpenID Connect, never granting the super-admin role. Tested so far against stand-in identity providers, not a live one
- Kiosks
- A token per device, stored as a SHA-256 digest. Staff mode behind a hashed PIN with lockout
- Outbound calls
- Webhook and feed targets on loopback, link-local or cloud metadata addresses are refused
Privacy by design, with the numbers.
A wayfinding kiosk has no reason to know who is standing at it. DigiMaps records what visitors searched for and where they went, not who they are, and starts a fresh anonymous session after each visitor.
- 5 Smallest group a statistic will show Anything smaller is suppressed (k-anonymity)
- 395 Days visitor analytics are kept by default Set 1 to 3,650 days per venue, then purged automatically
- 60 Seconds before an idle kiosk forgets the visitor Search, route, language and settings wiped. Default, set per device
- 0 Visitor accounts, sign-ins or personal-data forms
Wayvale Mall · standard pack
parcel for unit 12, call +971 50 123 4567
parcel for unit 12, call
[phone]
Phone numbers, e-mail addresses, ID-format numbers and long digit runs are replaced, in Latin and Arabic digits.
Wayvale General Hospital · hospital pack
dermatology follow-up for my father
search text not kept
Sensitive packs drop typed search and comment text before storage. The event still counts, without the words.
Where your data lives is your choice.
Choose on-premises to keep every byte on your own server, or a cloud region agreed in your contract. The difference matters most for hospitals and government sites, so here it is side by side.
| Question | On-premises (DigiMaps Server) | DigiMaps cloud |
|---|---|---|
| Where data sits | On your server and the backup locations you choose | In the region your contract names. The product itself does not enforce one |
| Outbound traffic | None by default. Only what you configure: a mail relay, webhook receivers, transit or flight feeds | HTTPS between your screens and the cloud |
| Backups | Nightly, encrypted, with a second copy. You move the decryption key off the server, and the status check warns until you do | Arranged in your contract |
| AI-assisted tracing | Off by default | Proposes room outlines that your team reviews. It sends floor-plan images to a third-party AI service and can be switched off |
| Visitor phones | QR hand-off needs guest Wi-Fi that can reach your server | Phones open the route over the internet |
There is no public self-serve DigiMaps cloud yet. Cloud hosting, and its region, are agreed in your contract. See what runs on an on-premises DigiMaps Server.
What we send your legal and infosec teams.
Security questionnaire, threat model and penetration-test scope are available under NDA. A UAE PDPL, Dubai ISR and Universal Design Code control mapping is available for your legal and information-security review.
| Security questionnaire | Our standard answers for an information-security review. | Under NDA |
|---|---|---|
| Threat model | Security objectives, trust boundaries, sensitive assets, the priority abuse cases and the control for each. | Under NDA |
| Penetration-test scope | What an independent tester will be asked to cover. No test has been run against it yet. | Under NDA |
| UAE control mapping | Data inventory, data flows, a retention schedule, a DPIA template and known gaps, mapped to UAE PDPL, the ICT Health Law, Dubai ISR and the Dubai Universal Design Code. | On request |
The UAE mapping is a working template, not legal advice or an attestation. Every row needs your own legal and compliance sign-off. Hosting and privacy notes by market: digital wayfinding in the UAE, indoor wayfinding in Saudi Arabia and indoor wayfinding in India.
Questions security and procurement teams ask
If your questionnaire asks something we haven’t covered, send it to us.
Is DigiMaps SOC 2 or ISO 27001 certified?
No. DigiMaps has no SOC 2 report and no ISO 27001 certificate, and we do not describe either as in progress. Our security questionnaire, threat model and penetration-test scope are available under NDA. Ask about our current compliance status.
Has DigiMaps had a penetration test?
Not yet. No independent penetration test has been carried out, and the written scope for one is available under NDA. Every change goes through static analysis, dependency and secret scanning, and scheduled OWASP ZAP API scans.
Where is our data stored?
Choose on-premises to keep every byte on your own server, or a cloud region agreed in your contract. On-premises, data stays on the server and the backup locations you choose, with no outbound traffic by default. In the cloud, nothing in the product pins a region, so the contract is what fixes it.
What does DigiMaps record about visitors?
Anonymous interactions: searches, places opened, routes and taps, with no accounts or sign-in. Personal data typed into search is scrubbed on the device and the server, hospital packs drop typed search text, figures from fewer than 5 visitors are hidden, and events are deleted after 395 days by default.
Does DigiMaps meet WCAG 2.1 AA?
It is designed to support WCAG 2.1 AA, with automated accessibility checks in our build pipeline. No third-party audit has been done, so we do not claim conformance and have no VPAT. Kiosks add reach mode, large text, 7:1 high contrast and step-free routing.
Can our legal team see the UAE PDPL mapping?
Yes. A UAE PDPL, Dubai ISR and Universal Design Code control mapping is available for your legal and information-security review. It is a working template, not legal advice or an attestation, and every row needs your own legal sign-off.
Put DigiMaps through your security review
Ask for the security questionnaire, threat model and penetration-test scope under NDA. We will walk your team through the evidence on a call, including what we don’t have yet.