Who We Partner With
Digital Signage for MSPs and IT Service Providers
Your clients trust you with their network. Add the screens that sit on it, and hand their IT team the evidence before they ask for it.
Every screen is an endpoint
A display in a lobby is a computer on your client's network. Leave it unmanaged and it becomes the device that never gets patched, with a login nobody remembers.
Once it's managed like the rest of the estate, it's another service you bill for. firmChannel gives you the controls, the evidence and the support to run it that way.
The security questionnaire, answered
Your clients' security teams will ask. Here are the answers, in one place.
| Question | Answer |
|---|---|
| Independent audit? | SOC 2 Type II: unqualified opinion, no exceptions noted |
| Can the client see it? | Yes. We send the report to your client under NDA |
| Penetration testing? | Annual, by an independent third-party firm. The latest found no Critical or High issues, and the full report is available |
| Isolation? | Each client is its own enterprise, with a dedicated instance and a private database |
| Blast radius of a leaked login? | One client. Every enterprise has its own separate sign-in, by design |
| Data location? | AWS in Canada and the US; each client's data is hosted in its own country |
| Sign-in? | SSO on the Enterprise edition; MFA with passkeys or authenticator apps; inactive accounts locked after 90 days |
| Encryption? | AES-256 at rest with AWS-managed keys; backups encrypted with AWS KMS; TLS 1.2 or higher in transit |
| Platform monitoring and hardening? | Web application firewall, continuous threat detection on our AWS accounts and servers, monthly vulnerability scans, weekly malware scans, nightly Critical and High OS security updates, code scanning on every pull request, and MFA on all production access |
| Fix times? | Critical vulnerabilities found by our scanning fixed within 72 hours or contained with compensating controls, High within 14 days |
| Logs? | Detailed activity logs, with AI actions attributed to the user (Enterprise edition); security event logs kept for a year; logs provided on request for your SIEM |
| Backup and recovery? | Encrypted daily, weekly and monthly backups; restore tests every quarter; a disaster recovery exercise every year; a 24-hour recovery point objective |
| If the CMS is unreachable? | Players keep showing cached content |
| Insurance? | Corum carries cyber liability insurance |
Digital signage data residency in Canada and the US
Ask any signage vendor where your client's data is hosted, and where the backups and logs end up.
firmChannel runs on AWS in both Canada and the US. Each client's data is hosted in its own country, so you can meet Canadian and US data-residency requirements from one platform. For public sector, healthcare and finance clients, that's one line on the questionnaire instead of a week of email.
Run it like the rest of your stack
- Fleet view: a live health dashboard, remote restart, screenshot and display power, and per-player offline alerts to the technician email you choose
- API: a REST API covering players, playlists, schedules, groups, locations, media and data feeds, with key-based authentication
- Access control: granular permissions, down to who may send RS-232 commands to a display
- Scale: tag-based playlists that fill themselves from media tags, so new content reaches the right screens
- Data boards: Smart Lists fed from spreadsheets, CSV links or SFTP drops, for clients who want KPI or operational boards
- Hardware choice: the same features on every supported player, with display control on Samsung Tizen and LG webOS natively and on other commercial displays over RS-232
AI your clients can switch off
AI features are on the Enterprise edition only, and an administrator can turn every one of them off, before deployment if you like. Customer data isn't used to train AI models. AI features use third-party providers, so a client who needs all processing kept in their own country can switch AI off.
So when a client's policy says "no generative AI", you can agree to the policy and still sell the platform.
How support and training work
You stay first line for your client, the same as every other service you run. When your NOC escalates, our Customer Success team picks up, 9 AM to 9 PM ET on weekdays (excluding statutory holidays), at no extra charge.
The same team trains your technicians on setup, player management and first-line support in live sessions, and the training video library inside the platform is there for whoever joins your team next.
We'll help with the security review and the proposal
When a client sends a long vendor security questionnaire, you don't have to answer it alone. We've completed them for hospitals, banks and public agencies, and we'll help you with yours. If the client wants a priced proposal, or there's a public-sector RFP to answer, we'll do that with you too.
Work with us your way
You already run the network, so you may only want the software. That's fine. Or use us for as much as a turnkey job, including installation and content creation, so you can sell screens without sending a technician up a ladder. Either way, you're assigned a channel manager, the platform can carry your brand instead of ours, and we never sell firmChannel direct to your clients. We don't publish partner margins, but we'll help you build every quote.
Questions to ask your current platform
| Question | firmChannel | Why it matters |
|---|---|---|
| Can my client's IT team get your SOC 2 Type II report and your full pen test report? | Yes. SOC 2 under NDA, and the full pen test report | Your client's security team will ask for the full report anyway |
| If one of my logins leaks, how many clients are exposed? | One. Every client enterprise has its own sign-in, by design | Your reputation shouldn't hang on one password |
| Can you meet my client's data-residency requirements, in Canada or the US? | Yes. We host in both countries, and each client's data stays in its own | Public sector, healthcare and finance contracts often require it |
| Is each client its own enterprise, with a private database? | Yes, every client, by default | Shared databases are the first thing a client's security team flags |
| Do you support passkeys? | Yes, along with authenticator apps | Phishing-resistant sign-in is on more security checklists every year |
| Can AI be switched off completely? | Yes, by an administrator, before deployment if needed | "No generative AI" clauses are showing up in contracts |
| Will you help with the security questionnaire and the proposal? | Yes | That's where your time goes on every new client |
FAQ
Questions MSPs ask
Can our client see your SOC 2 report?
Yes. We send it to them under NDA.
Can we share your pen test report?
Yes, the full report.
Where is client data stored?
On AWS, in the client's own country. We host in both Canada and the US.
Why does each client have its own sign-in?
So that a leaked password can only ever reach one client. It's a deliberate design choice.
Do you support single sign-on?
Yes, on the Enterprise edition.
Can AI be disabled?
Yes. An administrator can switch off every AI feature.
Who picks up when our NOC escalates?
Our Customer Success team, on weekdays from 9 AM to 9 PM ET.
Will you help with a client's security questionnaire?
Yes, and with the proposal.
Add signage to your service catalogue
Book a call with your channel manager, or ask for our SOC 2 and pen test reports first and let your security people take a look.