4.4.3. Skies Security Information

Infrastructure Security

• All data traffic within the Skies infrastructure is safeguarded using SHA-256 encryption paired with RSA encryption.
• Low-level access to Strawberry systems is not granted to Skies hubs.
• Root context is not utilized for the execution of Skies-facing components on Strawberry systems.

Content Security

• All streaming proxies that can be accessed via Skies are pre-encrypted on the Strawberry system using AES with a key length of 128 bits.
• Every asset is encrypted with a unique pair of encryption and decryption keys.
• Only encrypted content can be at rest in CDN & browser caches.
• Regional geo-blocking of caches is supported.
• All media content that can be accessed via Skies can be watermarked.
• No company or user data is ever stored on Skies hubs.
• Projective does not have access to its customer’s content unless the customer explicitly provides access.

Authentication Security

• Robust password practices are mandatory for all Skies users.
• All passwords are stored as cryptographic hashes on the Strawberry system.
• Strawberry supports Single Sign-on (SSO) for a wide range of services via the OpenID Connect protocol. Supported services include Okta, MyID, Azure AD and many more.

Skies Hub Security

• Strawberry systems directly connect to Skies Hubs through encrypted SSH tunnels.
• Skies hubs only store the bare minimum of data that is required for their functionality.
• All data stored on Skies hubs is anonymized.
• Skies hubs don’t have a management interface.

Availability Zones

• The Skies infrastructure is hosted across several data centers and availability zones around the world.
• Strawberry servers are always connected to all Skies Hubs in all regions, ensuring service availability even if an entire data center goes down.
• Multiple Skies hubs per geographical region ensure high availability.
• Encrypted content is served via CDNs in the requesters’ regions.