Security and trust
Built so procurement and IT say yes quickly.
EventOS holds attendee lists, exhibitor leads and payment references for events across the region. Here is how that data is isolated, encrypted, audited and kept in Singapore, in enough detail for a security questionnaire.
- Singapore-region database and backups
- Row-level security on every data table
- No card data, no held funds
- Audit log export, SSO on Enterprise
Practices
What protects the data
Data stays in Singapore
The database runs in the Singapore region. Backups stay in the same region. Application servers are stateless and keep no attendee data.
Row-level isolation
Every table carrying organiser, exhibitor or attendee data has row-level security. The app connects as a restricted role and each query runs as the signed-in person, so one organisation can never read another's rows.
Secrets sealed at rest
Payment provider keys, identity provider secrets and integration URLs are encrypted with a key the application role cannot read back. Sign-in links and API keys are stored hashed.
Your money never touches us
Ticket and exhibitor payments go straight to your own Stripe, HitPay, 2C2P, Adyen, NETS or PayPal account. EventOS verifies every webhook signature and never sees card numbers.
Consent before contact
Exhibitors receive an attendee's details only after the attendee accepts a scan and chooses what to share. People can see and withdraw what they shared.
Audit trail
Money, approvals, access changes, exports and platform-staff impersonation are written to an audit log you can export. Sign-in uses one-time links; no passwords to leak.
Least-privilege roles
Owner, admin, finance, marketing and check-in roles map to database policies, not just menus. Door staff see a scanner and nothing else. Enterprise adds single sign-on.
Rate limits and signing
Sign-in, exports, the API and the concierge are rate limited per person, key and network. Outgoing webhooks are signed so your systems can verify them.
Tested on every change
Isolation between organisations, exhibitors and attendees is covered by integration tests that run on every change, alongside payment, check-in and billing flows.
Subprocessors
Who else touches the data
Only what each service needs, under its own data processing terms. We update this list before adding a provider.
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting and edge network | Asia-Pacific |
| Supabase (PostgreSQL) | Primary database and backups | Singapore |
| Resend | Transactional email delivery | Global |
| Stripe, HitPay, 2C2P, Adyen, NETS, PayPal | Payment processing, only the providers you connect | Per provider |
| Anthropic | Optional: the attendee concierge and summaries, when the organiser's deployment enables them; programme content only, never payment data | United States |
Questionnaire
The questions we get asked
The security and data residency statement and privacy policy are the contractual versions.
Email legal@eventos.rewardland.sg with steps to reproduce. We acknowledge within two business days, keep you informed until it is fixed, and credit reporters who want it. Please do not test against other organisers' data; the demo workspace is there for that.
Where is data stored and processed?
How is one organiser's data kept from another?
Is personal data encrypted?
Who at Reward Land can see our data?
How do you handle attendee consent and PDPA?
Can we delete data after an event?
Backups and recovery?
Do you support single sign-on?
Need the paperwork?
Data processing terms, the subprocessor list and a completed security questionnaire are available on request.