Security

What we do

• Encrypted connections. The whole site runs over HTTPS, and browsers are told never to use an unencrypted connection (HSTS).
• Limited access to data. Security rules in the database mean each person sees only what they're allowed to, such as the guests of their own events and nobody else's.
• Two-factor sign-in. Turn it on with an authenticator app in Settings. It's required for admin tools.
• Staff actions are logged. Email addresses are masked for administrators, and every admin action goes into a log that can't be edited.
• Payments. Cards are entered on our payment processor's checkout page. EventX never sees or stores card numbers.
• Hosting. Our database and uploaded photos are hosted in a Canadian region (Montréal). Our privacy policy lists the providers that process data elsewhere.

Report a vulnerability

Found a security problem? Email support@eventx.ca with the subject “Security report” and the steps to reproduce it. We aim to reply within 5 business days.

If you act in good faith, only access your own data or test accounts, don't disrupt the service and give us time to fix the problem before talking about it publicly, we won't take action against you.

If something goes wrong

If a breach creates a real risk of significant harm, we notify the people affected and the Office of the Privacy Commissioner of Canada, and Québec's Commission d'accès à l'information where the law requires it.