Security
Built for the questions your security team asks.
Passkeys, encrypted tickets, a database per organisation, and an audit trail that covers your people and your AI alike.
Getting in
Passkeys
Sign in with Face ID, Touch ID or a hardware key instead of a password — for your team, your admins and your exhibitors alike. Available on every login surface, with a prompt to set one up.
Two-factor authentication
One-time codes by email, hashed at rest, valid for ten minutes. Five wrong attempts invalidates the code entirely. A device can be trusted for thirty days.
A forged ticket does not open the gate
Every ticket QR is an encrypted payload. Copy it, edit it, or generate one from scratch and it fails to decrypt — the gate refuses it, and the refusal is recorded alongside the admissions.
Your data is in its own database
Not a shared table with an organisation column. Each customer gets their own database, identified by their own domain. There is no query anyone could write that reaches across the boundary, because the boundary is the database itself.
Who can do what
Three roles
Admin, Editor and Viewer, checked on the action rather than by hiding a menu. A stakeholder can be given visibility without edit rights.
Scoped API tokens
Named, optionally expiring, revocable at any time, and issuable only by an Admin. AI access is a separate opt-in per token.
Audit trail with channel
Every change records who made it and how it arrived — the app, the assistant, an external AI key, a device, or the system. The log filters on that channel.
The AI cannot delete anything
There is no delete tool at any permission level — the capability is absent, not switched off. Every create and update returns a preview first and writes nothing until confirmed, an API key's reach is the overlap of its own scope and its owner's real permissions, and writes are rate-limited.
Card numbers never reach us
Card payments are processed by Stripe. Event Base holds the record of the order — what was bought, by whom, for how much — not the card.
Send us your security questionnaire
Infrastructure, hosting region, backup and recovery policy, sub-processors and compliance posture are handled through the security pack and direct questionnaire responses. Ask and a person will reply.
Questions we are asked
- Is our data mixed with other organisations'?
- No. Each organisation has its own database, identified by its own domain — not a shared table separated by a column.
- Can we require passkeys?
- Passkeys are available on every login surface and users are prompted to set one up. Talk to us about your policy requirements and we will tell you exactly what is enforceable today.
- Can a ticket be copied?
- The image can, but the code cannot be reused where you do not allow re-entry, and an altered or forged code fails to decrypt at the gate.
- Do you store card details?
- No. Stripe processes the payment; we keep the order record.
- Can we see what an AI tool changed?
- Yes. Every change carries the channel it came through, and the activity log filters by it — so "what did the AI change last week" is one filter.
Bring us your requirements
We will tell you what we can evidence today, and what we cannot.