Home/Security
Trust & compliance

Security at Eventira

Your attendees trust you with their data, and you trust us with it. Here’s how we keep it safe, from encryption to breach response.

EU / EEA-hosted GDPR-ready AES-256 encryption DPA available

Encryption

  • At rest: AES-256 encryption for stored data.
  • In transit: TLS 1.2+ for all connections between you, attendees, and our servers.

Access control

  • MFA-enforced access for our team, on a least-privilege basis.
  • Staff are bound by confidentiality obligations and only access data when necessary to operate the service.
  • You control your own team’s access from within the platform.

Infrastructure & hosting

Eventira is hosted in the EU/EEA on reputable cloud infrastructure. Attendee data is stored and processed within the EEA (Amsterdam, Netherlands). Transactional email is delivered by Postmark in the United States under Standard Contractual Clauses, and attendee networking/matching is operated in-house. Every transfer outside the EEA is listed in the table below.

Sub-processorPurposeLocation
DigitalOcean (cloud hosting)Infrastructure & data storageAmsterdam, Netherlands (EEA)
Postmark (ActiveCampaign)Transactional email deliveryUnited States (Standard Contractual Clauses)
CloudflareWebsite hosting & delivery for eventira.comGlobal edge network
OdooWebsite live chat & CRMEU (Odoo Online)
AblyReal-time messagingEU/Global edge
Google FirebaseIn-app analytics & crash reportingEU/US (SCCs)
Eventira (in-house)Attendee networking & matchingIndia
Google AnalyticsWebsite analytics (consent-gated)EU/US (Consent Mode)

Testing & monitoring

We run regular security testing and monitoring, and keep our stack patched and up to date.

Breach response

We maintain a tested incident-response procedure. In the event of a confirmed personal-data breach, we notify the affected controller within 72 hours with full details.

Your data, your control

Attendees and account holders can manage and delete their own data at any time (see deleting your account). On termination, we delete or return data within 30 days, subject to documented retention.

Reviewing us for a deal? See our GDPR & DPA page (including a downloadable DPA), or email [email protected] with any security questions.
FAQ

Common questions.

Is Eventira GDPR-compliant?
Yes, Eventira is GDPR-ready, with a DPA available for review. Attendees and account holders can manage and delete their own data at any time.
How is my data encrypted?
Data is protected with AES-256 encryption at rest and encryption in transit.
Where is Eventira hosted?
In the EU/EEA, attendee data is stored and processed within the EEA (Amsterdam, Netherlands). Transactional email is delivered by Postmark in the United States under Standard Contractual Clauses, on reputable cloud infrastructure.
Who on Eventira's team can access our data?
Access is MFA-enforced and least-privilege. Staff access data only when necessary to operate the service, under confidentiality obligations, and you control your own team's access from within the platform.
What happens in the event of a data breach?
Eventira maintains a tested incident-response procedure. In a confirmed personal-data breach, the affected controller is notified within 72 hours with full details.
Can we get a DPA for a security review?
Yes, a DPA is available (downloadable on the GDPR & DPA page). For any security questions, email [email protected].
What happens to our data if we leave?
On termination, data is deleted or returned within 30 days, subject to documented retention.