Trust & Security

• Email + password sign-in with leaked-password protection enabled.
• Optional social sign-in providers.
• Sessions are signed JWTs delivered over HTTPS.
• Account actions like password reset and email change are confirmed by email.
• Rate limits on sign-up, password reset, and inquiry sending to prevent abuse.

• All traffic is encrypted in transit using TLS.
• Data at rest is encrypted in our managed Postgres database.
• Row-level security policies enforce that users only see their own data.
• Backups and point-in-time recovery are maintained by our infrastructure provider.

Card payments are processed by our PCI-compliant payment partner. EventCloud never stores raw card numbers. Vendor payouts use the partner's Connect platform with KYC verification.

EventCloud uses the following sub-processors to deliver the service. All are bound by data-processing agreements.

• Cloud hosting & database (US/EU regions)
• Email delivery (transactional emails)
• Payments & payouts
• Optional analytics (only if you opt in)

For a current list with addresses and processing locations, email legal@myeventcloud.com.

EventCloud secures the platform. You are responsible for choosing a strong unique password, keeping it secret, and reviewing the activity on your account. Vendors are responsible for their own business practices, including how they handle planner data outside of EventCloud.

Found something concerning? Email legal@myeventcloud.com with steps to reproduce. We respond within 3 business days and we'll credit you in our acknowledgements (with your permission) once the issue is resolved.

EventCloud has not undergone SOC 2, ISO 27001, HIPAA, or PCI-DSS audits as the platform itself. We rely on the certifications of our underlying providers (hosting, payments). For enterprise procurement questions, contact legal@myeventcloud.com.