Security

EventOS handles event operations data for volunteer-run organisations. This page explains the technical and organisational measures we use to keep that data safe.

Hosting and data residency

• All application data is stored in Supabase (Postgres) in the ap-southeast-2 (Sydney) region.
• The web app runs on Vercel, with functions pinned to syd1 (Sydney).
• Email delivery uses Resend (US).
• Rate-limit state is held in Upstash Redis (Australia).
• Payments (when paid plans launch) are processed by Stripe.

We do not transfer EventOS data outside the regions listed above.

Encryption

• In transit. All traffic uses HTTPS with TLS 1.2 or higher.
• At rest. AES-256, managed by Supabase and the underlying cloud providers.
• Passwords. Hashed by Supabase Auth. We never see plain-text passwords.
• Tokens. Volunteer manage tokens and fetcher tokens are 32-byte cryptographically random values.

Access control

• Row-Level Security is enabled on every application table. The anonymous public key cannot read user data.
• Multi-role memberships are enforced server-side on every authenticated call.
• Last-admin guard prevents accidentally locking yourself out of your organisation.
• Service-role credentials are used only on the server, never exposed to the browser.
• Team invites are email-bound, single-use, expire after 7 days, and are revoked on accept or resend.

Application security

• Strict Content Security Policy, HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, restrictive Referrer-Policy and Permissions-Policy.
• Rate limiting on authentication and public mutations.
• File upload validation that sniffs magic bytes for images.
• CSV exports sanitised to prevent formula injection in spreadsheets.
• Generic error messages on auth flows to prevent account enumeration.
• Timing-safe comparison on cron and webhook secrets.

Software development

• TypeScript throughout, type-checked on every build.
• Continuous integration runs typecheck, lint, unit tests, and pnpm audit on every push.
• Three-environment setup: local, staging, production.
• Production deploys only via signed git tag (v*.*.*).

Backups and recovery

• Supabase performs daily encrypted backups, retained for up to 35 days.
• Point-in-time recovery available on the production database.

Incident response

If we discover a security incident affecting your data we will:

1. Investigate and contain the incident as quickly as practical.
2. Notify affected account holders without undue delay, normally within 72 hours of confirming the impact.
3. Notify the Office of the Privacy Commissioner where required under the Privacy Act 2020.
4. Provide a post-incident report explaining what happened, what data was affected, and what we changed.

To report a suspected vulnerability or incident, email security@eventos.nz. We acknowledge good-faith disclosures.

Sub-processors

Our current sub-processors are listed at /legal/sub-processors. We notify account holders by email at least 14 days before adding a new one that handles personal data.

What we don't yet have

We are honest about gaps. As of this version we do not yet have:

• A SOC 2 or ISO 27001 certification.
• A formal third-party penetration test (planned before paid launch).
• 24/7 on-call coverage; response is best-effort during NZ business hours.
• A bug-bounty programme.

We will update this page as these change.

Contact

Security disclosures: security@eventos.nz
Privacy: privacy@eventos.nz