Protective DNS for the box office, backstage and the bar
A theatre holds customer data in its box office, takes payments at the bar and runs lighting and sound over the network. Visiting companies plug in their own laptops in the get-in. Shield checks each lookup before a connection starts, so phishing, malware and C2 callbacks stop there. Audience WiFi in the foyer comes second, family-safe for the panto season.
What is at stake
Where a theatre network is exposed
Phishing aimed at the box office
Box office teams handle customer records and refunds by email. One convincing fake login page can expose the whole patron database.Touring crews on your network
Visiting companies bring laptops and kit you have never seen. An infected one can call home from your backstage network mid-run.Show control on a shared network
Lighting consoles, sound desks and show control servers fetch updates online. They need a narrow, known list of destinations, not the open internet.
How Shield fits
Front of house, backstage and audience, kept apart
- Box office and bar ePOSThreat-first policy on ticketing, bar tills and card terminals, with domains registered in the last 30 days blocked.
- Lighting, sound and showShow control on its own VLAN, allowed to reach its update domains and little else, visible through the relay.
- Company and crew WiFiThreat defence for visiting companies, with VPN and proxy apps blocked so traffic stays inside policy.
- Audience WiFiFamily-safe categories, Safe Search and ad blocking in the foyer, bars and auditorium.
Guest WiFi policy
- Adult contentBlocked
- GamblingBlocked
- Safe Search on Google, Bing and YouTubeEnforced
- Streaming at busy timesLimited
Allow list
bookings.examplemenu.exampleBlock list
rival-venue.exampleProof
What Shield brings to a theatre
- 10 days
- earlier warning of new phishing and malware domains than standard blocklists
- 62%
- fewer DNS queries on audience WiFi once ads and trackers are blocked, in Purple's tests
- IWFfiltering meets the Internet Watch Foundation bar on audience WiFi
- ISO 27001held by Purple, alongside Cyber Essentials, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Can visiting companies use a VPN to get round it?
Shield blocks VPN and proxy apps with one click, so a crew laptop on your company WiFi stays inside policy. You can allow a named domain for a touring production that needs it, then remove it when the show closes.
Will it interfere with lighting and sound during a show?
No. Show control keeps reaching the domains you allow, and Shield checks each lookup before the connection starts, so nothing in the signal path changes. You can see which console looked up what through the relay.
Do we need an IT team to run it?
No. Point the router, firewall or DHCP at Shield, with no hardware to install. Policy sits in one dashboard, and scheduled PDF reports go to whoever looks after the building, whether that is a technical manager or a contractor.
How does Shield handle audience data?
Shield sees DNS lookups, not the content of pages or messages. Purple holds ISO 27001 and Cyber Essentials, and works to GDPR and CCPA. You choose whether to stream logs to your own systems, such as Microsoft Sentinel or syslog.
What happens if Shield goes down during a performance?
Shield runs on a dual anycast DNS network and fails closed, so an outage never leaves the building unfiltered. Your box office, bar and audience networks keep their policy whichever node answers.
Other industries
Cinemas
Threat defence for ticketing, kiosks and concession tills, with family-safe WiFi in the foyer.Music venues
Threat defence for door scanners, cashless bars and production kit, with lighter fan WiFi.Theme parks
Threat defence for gates, queue systems and tills, with family-safe WiFi across the park.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.