Tenant isolation
Access rules are enforced in the database itself, not only in application code. Every table carrying customer data is governed by row-level security policies keyed to your organization, your membership of an event, a city reviewer’s jurisdiction, or a vendor’s assignment. A query that escapes the application layer still returns nothing it should not. Uploaded documents live in private storage buckets and are served through short-lived, authorized URLs rather than public links.
Accounts and authentication
- Passwords are hashed by our authentication provider and never stored or logged in readable form.
- Multi-factor authentication is available, and required for privileged administrative access.
- Sessions are carried in HttpOnly, SameSite cookies that scripts cannot read, and are invalidated on sign-out and password change.
- Roles and permissions are scoped per organization and per event, so access follows the job rather than the person.
- Sign-in attempts, invitations, and sensitive administrative actions are recorded with an audit trail.
Transport and browser hardening
All traffic is served over TLS and pinned there by HSTS with preload. The application sets a strict Content Security Policy, denies framing outright, disables MIME sniffing, restricts referrer leakage, isolates browsing context with same-origin opener and resource policies, and switches off camera, microphone, payment, and USB access through Permissions-Policy. Pages reached by shared link additionally send no referrer, forbid caching, and ask search engines not to index them.
Shared links deserve care
Proposal, invitation, calendar feed, and site-map links are deliberately usable without an account — that is what lets a vendor sign a quote or a neighbor read a plan without being onboarded. It also means the link is the credential. Anyone holding a valid link can open what it grants.
- Send these links only to the person who should have them, and prefer a channel that is not a public thread or a shared inbox.
- Revoke a link once its purpose is served, and revoke immediately if it was forwarded or posted somewhere unintended.
- Treat a link in a forwarded email chain as compromised.
Infrastructure and data handling
Data is encrypted in transit and at rest by our hosting and database providers, who maintain their own independent audits — see Subprocessors. Managed backups run on the database with point-in-time recovery. Service credentials are scoped to the minimum required, held in the deployment platform’s secret storage, and rotated when staff or vendor relationships change. Administrative access to production is limited to the people who need it and is logged.
What we ask of you
- Use a unique password and turn on multi-factor authentication.
- Invite people at the lowest role that lets them do their work, and remove access when someone leaves the event or the organization.
- Upload only what the event actually requires — a certificate of insurance rarely needs a full policy schedule attached.
- Tell us quickly if an account, device, or shared link may have been compromised.
Reporting a vulnerability
We welcome reports from security researchers and will not pursue legal action against anyone who investigates and reports in good faith under the terms below. Send findings to security@myeventscape.com with enough detail to reproduce the issue — steps, affected URL, and what you were able to reach.
Good faith means:
- Test only against accounts and organizations you control, and create your own test data.
- Stop as soon as you have confirmed a vulnerability, rather than pivoting further into the system.
- Do not access, modify, download, or retain another customer’s data, and delete anything you encountered incidentally.
- Do not run denial-of-service tests, send bulk automated traffic, or use social engineering or physical attacks against our staff or providers.
- Give us a reasonable opportunity to fix the issue before disclosing it publicly.
We aim to acknowledge a report within two business days and to keep you updated as we work through it. We do not currently run a paid bounty program, but we are glad to credit researchers who would like the recognition.
If something happens
No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will notify affected customers and, where required, regulators, within the timeframes applicable law and any signed agreement impose. Notice will describe what we know, what we are doing, and what we recommend you do. Customers subject to public records or breach notification statutes should tell us during onboarding so their obligations are built into the response.