Security
Seven claims below, each pointing at a mechanism rather than a badge. If you want to check one against the code yourself, ask — we would rather you verify it than take our word for it.
Every tenant table runs row-level security with FORCE ROW LEVEL SECURITY, under a runtime role that does not own the tables. A test deliberately bypasses the application layer and queries as that role directly — it proves the database alone denies a cross-tenant read, not just the application code sitting in front of it.
Tickets are signed with HMAC-SHA256 using a key derived per event, so a key leaked from one event forges nothing for another. Only the digest is stored server-side — a database dump is never a stack of working tickets — and bumping an event’s version revokes every code issued before it in one action.
Access is role-based with a permission guard on every route, and every staff assignment is scoped to one event. A check-in volunteer for one show has no path to a screen that belongs to a different one.
Privileged actions are logged with who performed them, when, and what changed, on a screen gated by its own permission — so a question about who approved or changed something has a real answer to point to.
Passwords are hashed with argon2id, tuned above the OWASP minimum for memory cost. Refresh tokens are single-use and rotate on every exchange, with reuse detection: if an already-rotated token is presented again, the entire session family is revoked rather than trusting the newer one blindly.
An organiser can supply their own HTML for a public event page. It renders inside an iframe with an empty sandbox attribute — the maximally restrictive setting — rather than a trust decision made per document.
The platform ships as containers with a documented runbook, and the event and WhatsApp APIs each publish their own OpenAPI definition, so self-hosting is a real option, not a hypothetical one. Your event data is never locked behind a SaaS-only deployment you cannot leave.
Said first, not found later
Procurement teams check for these. We would rather be the vendor that tells you before you ask than the one you catch out.
Enterprise single sign-on, being built on the record that exists today.
Automated user provisioning from an identity provider, not yet built.
Formal security certification — not yet undertaken, and not yet claimed.
A security briefing walks through the isolation test, the QR signing scheme and the audit trail live, on a call with whoever needs to sign off.