Security overview

The short version

The service is a demo: a static website whose accounts, projects, holds and sales are kept in each user's browser. That keeps your data on your device, but it also means some protections a production service needs are not in place yet. This page says plainly which is which.

In place today

• HTTPS everywhere. Every page, file and message is served over TLS by our host.
• No server-side personal data. Accounts, projects, guest lists, holds and demo sales are stored in the browser (see the cookie and browser storage policy), not in a database of ours.
• Passwords are hashed (salted SHA-256) before they are stored in the browser. We never see them.
• Payments stay with the partner. The seat map never receives card or mobile-money details.
• Share links carry only the project they were made for; large images are left out of the link.
• Private projects are hidden from other accounts in the dashboard and templates.

Not in place yet (be aware)

• Demo accounts are not real logins. Anyone with access to the same browser profile can use them. Use your own device.
• Private projects are hidden, not protected. The static site ships every built project's data to every visitor; hiding it in the interface is not access control.
• Share links are bearer links. Anyone who has the link can open what it carries. Send them only to the people who should see the project.
• Origin allow-list enforced in the page only. The seat map ignores messages from, and posts nothing to, sites not on the event's list, and opens view only there. Hosting does not yet send frame-ancestors, so other sites can still frame the map (view only).
• No audit logs, rate limiting or account recovery.

Roadmap

• Server authentication (email, Google and Microsoft sign-in) with protected sessions.
• Private projects and share links checked on the server, with expiry and revocation.
• Server-side seat holds and inventory; the origin allow-list enforced for every embed.
• Encryption at rest, backups and tested restore.
• Audit logs for sign-ins, shares, exports and ticket changes.

Progress is on the roadmap.

Reporting a vulnerability

Email [Privacy contact email] with the details and steps to reproduce. Please give us reasonable time to fix it before telling anyone else, and do not access other people's data or disrupt the service while testing. We will acknowledge within 3 working days.