A wall shows your board, and nothing more.
JamBoards walls play only on screens you have paired, and each screen can reach only what its active board shows. Camera passwords and account tokens are encrypted at rest and never returned by any API. API keys are scoped and revocable, and connected accounts are read only.
How JamBoards protects your walls and accounts
Walls play only on paired screens
An unpaired browser that opens a wall address sees a pairing code, not your board. Pairing codes expire after 10 minutes and pairing attempts are rate limited.
Secrets are write-only
Camera passwords, Home Assistant tokens and connected account tokens are encrypted at rest. No API answer, MCP tool or OpenAPI document returns them.
Screens see only what they show
Every camera frame, calendar and Home Assistant state a wall asks for is checked against its active board, on every request.
Scoped, revocable API keys
Keys carry read, write or admin scopes, are stored as a SHA-256 hash, are shown once, and can expire or be revoked.
Read-only connected accounts
Google Calendar, Microsoft calendars and Spotify are read only. JamBoards never creates, changes or deletes anything in them.
HTTPS everywhere
The app and the walls talk over HTTPS. The admin session cookie is HttpOnly and Secure, with CSRF protection on every change.
Found a vulnerability? Email hello@jamboards.io.
Security questions
Can someone else open my wall by guessing its address?
No. Walls play only on screens you have paired. An unpaired browser that opens a wall address sees a pairing code, not your board, and a revoked screen goes dark at once.
How does JamBoards store passwords and tokens?
Camera passwords, Home Assistant tokens and connected account tokens are encrypted at rest and write-only: no API answer, MCP tool or export ever returns them. Errors are scrubbed of secrets before they are stored or shown.
What can a wall screen see?
Only what its active board shows. A wall asks JamBoards for each camera frame, calendar or Home Assistant state, and JamBoards checks on every request that the board names it. A screen never receives a token or a password.