Security
Your conference data, protected
We build with recognized secure-development practices and are honest about what we do and do not claim. The controls below reflect how the platform actually works today — not aspirations. For the full picture, visit our Trust Center.
Data protection
- TLS everywhere with HSTS (max-age one year, preload) — traffic is encrypted in transit end to end.
- PostgreSQL is managed and schema-migrated with Alembic; uploads live in an S3-compatible object storage bucket, served only to authorized users.
- PII is minimized by design — for example, email addresses are not sent to the AI.
- Secrets are stored server-side only and are never exposed to the browser.
Application security
- A Content-Security-Policy plus X-Frame-Options: DENY and X-Content-Type-Options: nosniff harden the browser surface.
- Output is escaped to prevent stored XSS — including inside JSON-LD structured data.
- SSRF protection blocks outbound webhooks to internal and link-local address ranges.
- Every organizer role is enforced server-side, and data is scoped per conference so one organizer cannot reach another's records.
Authentication & access
- Authentication uses JWTs stored in httpOnly cookies, keeping tokens out of JavaScript's reach.
- Passwords are hashed with bcrypt.
- Per-IP rate limiting and per-account lockout slow down brute-force attempts.
- Login and registration responses are non-enumerating, so they do not reveal whether an account exists.
Payments
- Card data is handled entirely by Stripe (PCI-DSS Level 1) — the application never stores card numbers.
- Payments run through Stripe's hosted flow; prices are set server-side.
- The platform is currently in Stripe test mode pre-launch, so no live charges are processed yet.
AI & privacy
- AI assistance (Google Gemini / Google AI) is advisory and human-in-the-loop — it never makes final decisions, assigns reviewers, or notifies authors automatically.
- We minimize what is shared with the AI; personal data such as email addresses is not sent to it.
- Analytics are first-party with no third-party advertising trackers, and cookie/analytics consent surfaces are provided.
Monitoring & response
- Sensitive actions are recorded in an audit log for accountability and investigation.
- Application errors are monitored with Sentry so we can detect and respond to issues quickly.
- Security reports are welcome through our responsible disclosure process.
Compliance status
An honest note on certifications. Our security program is aligned with SOC 2 and ISO 27001 principles, and formal certification is on our roadmap. We are not currently SOC 2 or ISO 27001 certified, and we will not claim otherwise.
On privacy, we take a GDPR-minded approach: data minimization, self-service data export (GET /users/me/export), and account deletion that scrubs personal data. Some financial records are retained where required for legal and accounting compliance.
Payment card handling is delegated to Stripe (PCI-DSS Level 1); we never store card numbers. If your organization has specific compliance requirements, contact us and we will walk you through our current posture honestly.