Protective DNS for gallery staff, collections and visitor WiFi
Galleries hold collections records, loan agreements, artwork sales and environmental sensors that protect the work on the walls. Shield checks each DNS lookup against your policy before a connection starts, so phishing, malware and C2 callbacks stop at the lookup. Visitor WiFi comes second: quiet, family-safe access for audio guides and exhibition content, faster because ads are stripped.
What is at stake
Where a gallery network is exposed
Fake invoices on artwork sales
Sales and loans run on email between dealers, lenders and buyers. A spoofed login page is often how bank details get changed.Sensors that guard the collection
Temperature and humidity monitors report over the network. Compromised, they go quiet or become a way in.Contractor-built exhibition tech
Touchscreens and projection for each show are installed, connected and left running long after the opening.
How Shield fits
Separate rules for staff, collections and visitors
- Curatorial and sales staffThreat defense by Entra ID group, with new domains blocked to stop freshly registered phishing sites.
- Collections and sensorsEnvironmental monitors and collections systems on their own VLAN, limited to known domains through the relay.
- Shop and café tillsThreat-first policy on ePOS and card terminals, separate from the staff and visitor networks.
- Visitor WiFiFamily-safe categories and Safe Search, with ad blocking so audio guides load quickly.
Guest WiFi policy
- Adult contentBlocked
- GamblingBlocked
- Safe Search on Google, Bing and YouTubeEnforced
- Streaming at busy timesLimited
Allow list
bookings.examplemenu.exampleBlock list
rival-venue.exampleProof
What Shield gives a gallery
- 10 days
- earlier warning of new phishing domains than standard blocklists, from machine learning
- 500%
- faster page loads on visitor WiFi with ads stripped, in Purple's own tests
- IWFfiltering meets the Internet Watch Foundation bar on visitor WiFi
- ISO 27001held by Purple, alongside Cyber Essentials, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Does Shield stop payment diversion fraud?
Shield blocks the phishing domains that steal email logins, which is how most invoice fraud starts, including domains registered in the last 7 or 30 days. It does not check bank details, so keep your call-back process for any change of account.
Will it interfere with environmental monitoring?
No. Put sensors on their own VLAN and allow the domains they report to. The relay shows each device's internal IP, so if a monitor starts looking up something new you can see it in reporting.
Do we need hardware at each site?
No. Point the router, firewall or DHCP at Shield and every device on your networks is covered, with nothing to install. A relay covers segmented collections and sensor VLANs. Laptops taken to fairs and lenders rely on your existing endpoint protection while away.
Can staff use generative AI tools?
You decide. Shield blocks or allows generative AI apps with one click, by user group through Microsoft Entra ID or Active Directory. User behavior analytics show which AI tools staff already use, so you can set a policy on evidence.
What happens if Shield goes down?
Shield runs on a dual anycast DNS network and fails closed, so an outage never leaves the gallery's networks unfiltered. Staff, collections and visitor WiFi keep their policy whichever node answers.
Other industries
Cinemas
Threat defense for ticketing, kiosks and concession tills, with family-safe WiFi in the foyer.Theaters
Threat defense for box office, show control and bar tills, with family-safe audience WiFi.Music venues
Threat defense for door scanners, cashless bars and production kit, with lighter fan WiFi.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.