Security

Eventship is trusted by event hosts and communities to handle attendee data, payments, and communications. We take that responsibility seriously. This page outlines the security measures we have in place to protect your data.

Infrastructure

Eventship is hosted on Google Cloud Platform (GCP), which maintains a comprehensive set of security certifications including SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1.

Our web traffic is routed through Cloudflare, which provides DDoS protection, web application firewall (WAF), and content delivery network (CDN) services globally.

Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+. HSTS is enforced across the entire platform.
• At rest: Data stored in our databases and file storage is encrypted at rest using Google Cloud's default encryption (AES-256).

Authentication

User authentication is powered by Firebase Authentication, which provides industry-standard security for sign-in flows. We support multiple authentication methods including email magic links, email/password, Google, Apple, LinkedIn, and phone (SMS).

Our developer API uses API key authentication scoped to individual hosts. Our MCP server and third-party integrations use OAuth 2.1 with PKCE, preventing token interception attacks — there are no API keys for users to manage, rotate, or leak.

Access Control

• Hosts can only access attendee data for events they own — this is enforced server-side on every request.
• Co-host permissions are role-based, with distinct levels for owners, admins, and members.
• Admin and staff access is restricted to authorized personnel with elevated privileges.
• API keys are scoped to a single host and cannot access data belonging to other hosts.

Payments

All payment processing is handled by Stripe, a PCI DSS Level 1 certified service provider. Eventship does not store full credit card numbers, CVVs, or sensitive payment credentials on our servers.

We retain only the minimum payment references necessary to manage transactions (e.g., last four digits, expiration date, and subscription status).

AI Data Handling

We use Google Gemini through Vertex AI to power features like event categorization and attendee introductions. Under Google Cloud's enterprise terms, data sent to Vertex AI is not used to train Google's foundation models.

AI processing is limited to the specific task at hand — we do not send bulk user data to AI services. For details on what data is processed, see our Privacy Policy.

Development Practices

• All code changes go through pull request review before merging.
• Automated linting, type checking, and end-to-end tests run on every change.
• Secrets and API keys are stored in cloud-native secret management — never in source code.
• Dependencies are regularly reviewed and updated to address known vulnerabilities.

Incident Response

We monitor our infrastructure and application for anomalies and potential security events. In the event of a data breach, we will notify affected users and hosts within 72 hours as outlined in our Data Processing Agreement.

Our incident response process includes identification, containment, eradication, recovery, and post-incident review.