Security and data residency

Data residency

EventOS is hosted in the Singapore region. The primary database, backups, file uploads and email logs stay in Singapore; nothing is replicated to another region for storage.

Transactional email leaves the region only as far as the sending provider's edge, and only the message itself. Payment card data never touches EventOS: it is entered on the payment provider's hosted page (Stripe, HitPay, PayPal or Braintree) and EventOS stores only the provider's reference.

Organisers who connect their own tools (Slack, CRM or spreadsheet integrations, webhooks, the API) decide where that copy of the data goes; EventOS documents what each integration sends.

Isolation between organisations

Every database table that holds organiser or attendee data carries row-level security. The application connects as a restricted role and each query runs as the signed-in person, so an organiser, an API key or a webhook can only ever reach rows that belong to its own organisation.

Secrets that organisers give us (payment provider keys, Slack URLs, identity provider client secrets) are encrypted at rest with a key the application role cannot read back in plain text.

Access and authentication

Sign-in uses single-use email links that expire after 20 minutes, or single sign-on through the organisation's OpenID Connect provider on the Enterprise plan. Organisations can require SSO for their email domains.

Workspace roles (owner, admin, finance, marketing, check-in) limit what each person sees and does. Owners can revoke access at any time and every significant action is written to the audit log, which can be exported as CSV.

Operations

Backups are taken daily with point-in-time recovery; restores are tested as part of release checks. Dependencies are kept current and security advisories are triaged within one business day.

API traffic is rate-limited per key and per plan; sign-in and export endpoints are rate-limited per person and network. Webhook deliveries are signed so receivers can verify them.

Sub-processors

Hosting: Vercel (application) and a managed PostgreSQL provider in Singapore. Email: Resend. Payments: the provider each organiser connects. Domains and TLS: Vercel. A current list with locations is available on request; organisers are told in advance when it changes.

Reporting a concern

Security reports: legal@eventos.rewardland.sg. We acknowledge within two business days and keep reporters informed until the issue is resolved.