Three commitments
- We never sell data. Not yours, not your buyers'.
- We never hold ticket revenue. Bank-transfer payments go directly to your bank account; card payments, where offered, are processed by a licensed payment provider and settled to you. We never hold card data.
- We tell you when something goes wrong. Documented incident response with a 48-hour notification commitment to affected organizers.
Where your data lives
All primary processing and storage runs in the EU — AWS Frankfurt (eu-central-1). Our providers and their locations are public on the Subprocessors page, and we announce changes 30 days ahead.
Encryption, concretely
- TLS 1.2+ for everything in transit.
- Account passwords stored only as bcrypt hashes (cost 12).
- Bank API tokens, SMTP credentials and ticket secrets encrypted at rest with AES-256-GCM, key material manageable via AWS KMS.
- No "military-grade" claims — the previous three bullets are the actual controls.
Access control
- Role-based permissions at organization and event level. The flagship example: give a helper the scanner role and they can check guests in at one event — and see nothing else. Not sales, not revenue, not the guest list beyond scanning.
- Per-organization data isolation enforced in the service layer.
- Administrative actions are written to an audit log (who, what, when, from which IP), retained 365 days.
Built for the worst moment of your event
Check-in is offline-resilient by design: devices download the guest manifest ahead of doors, validate tickets locally when connectivity drops, and reconcile scans (including duplicate conflicts across entrances) when it returns. A dead Wi-Fi router does not stop your entrance.
Fraud and abuse protection
Orders are scored against server-observed signals (velocity, disposable emails, scripted clients), with organizer-controlled responses from flagging to review holds. Held orders are decided by people, not algorithms. Details in the Privacy Policy.
Development practices
Code review before deployment, CI checks, dependency updates, separated environments, no production credentials in code.
Responsible disclosure
Found a vulnerability? Write to [email protected]. We respond within
3 business days, we will not pursue good-faith research conducted without harming
users or data, and we credit reporters who wish it. A security.txt per RFC 9116 is
published at /.well-known/security.txt.
Certifications — the honest version
We are not SOC 2 or ISO 27001 certified today, and we do not claim to be. We build our controls in line with those frameworks (the measures above map to ISO 27001 Annex A and SOC 2 Common Criteria) and maintain internal gap analyses, so that when customer demand justifies a formal audit, the groundwork exists. GDPR is not a certificate — it is how we operate: public DPA, subprocessor list, EU residency, breach-notification commitments, and data subject rights handling via [email protected].
Security questions or questionnaires: [email protected].