Security policy

Protecting data

Uploaded media is encrypted before it is stored. Access to media and application data is checked against account, organisation and event permissions. Sensitive credentials and sign-in tokens are handled using one-way hashing and short expiry windows.

Operational controls

• Access to administrative functions is restricted and monitored.
• Production services use encrypted connections and environment-based secrets.
• We apply updates, review logs and maintain backups appropriate to the service.
• Security issues are investigated and access is limited to what is needed to resolve them.

Your responsibilities

Use a secure, private device, do not share magic links, and report suspicious activity promptly. Organisation administrators should review membership, event visibility and uploaded content regularly.

Reporting a vulnerability

Please report suspected vulnerabilities or unauthorised access privately to the organisation that manages your account, including the affected URL, a description and safe reproduction steps. Do not include real people's personal information in a report. We ask that researchers avoid accessing or changing data and give us reasonable time to investigate.

Limits

No online service can guarantee absolute security. We continuously improve safeguards and will assess and respond to credible reports proportionately.