Trust Center
Security and privacy you can verify.
Trust resources.
Everything a security, privacy or procurement reviewer usually asks for, each on its own page.
- Security
TLS everywhere, encrypted secrets, hardened authentication, and a defense-in-depth application design.
- Privacy
Data minimization, self-service export and deletion, consent-backed analytics, and no third-party ad trackers.
- Terms of Service
The agreement that governs your use of the platform, written in plain, predictable language.
- Cookies
What we store in your browser and why. First-party analytics only, with consent surfaces for optional cookies.
- Data Retention
Current public beta handling for each data category, recoverable conference deletion, and rolling backups.
- Subprocessors
The third-party services we rely on to run the platform, what each one processes, and how to get change notifications.
- Vulnerability Disclosure
Our responsible-disclosure policy, good-faith safe harbor, and how to report a security issue to our team.
- Accessibility
Our WCAG 2.1 AA engineering target, automated and manual release checks, and barrier reporting.
- System Status
Current availability signals for the API and web app, with production readiness details.
Standing commitments.
These hold on every plan, including the free tier.
- Encryption in transit (TLS) with HSTS on production responses
- Card data handled through Stripe-hosted checkout where payments are enabled — we never store card numbers
- Self-service data export and account deletion for every user
- First-party analytics only — no third-party advertising trackers
- Human-in-the-loop AI: assistance is advisory, never automatic decisions
- Honest compliance posture — we do not claim certifications we have not earned
Questions reviewers ask.
- Is Conferences.Center SOC 2 or ISO 27001 certified?
- Not currently. We do not claim SOC 2 or ISO 27001 certification. We describe current controls honestly and can discuss certification plans during procurement review.
- Where is my data hosted?
- The API and PostgreSQL database both run on Railway, the frontend is served by Vercel, and uploaded files use S3-compatible object storage. Public beta does not offer a customer-selected residency region. See our Subprocessors page for the current list.
- Can I export or delete my data?
- Yes. Every user can export their personal data (GET /users/me/export) and delete their account, which scrubs personal data. Some financial records are retained where required for legal and accounting obligations — see the Data Retention page.
- How do I report a security vulnerability?
- Email security@conferences.center with details and reproduction steps. We offer a good-faith safe harbor for responsible research. See our Vulnerability Disclosure page for scope and guidelines.
Have a specific compliance question?
Send us your requirements or questionnaire and we will answer it plainly.