Security and data protection: how Evnty handles your event data

Evnty runs on Cloudflare. The database, file storage and real-time rooms of the app are pinned to the EU jurisdiction. Requests are received by the Cloudflare data centre nearest to you.

Some services run in Cloudflare's global network without an EU binding: PDF generation, receipt recognition, email delivery, background tasks and logs. They process data while a task runs. The search index for AI connections is not EU-bound either and is kept while an organisation uses that feature. Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses. The privacy policy has the details.

People sign in with a password of at least 12 characters, a sign-in link or a passkey, with two-factor authentication through an authenticator app on top if they like. Organisations can require two-factor authentication for every member. Without it, the API refuses access to the organisation's data.

Sign-in cookies are HttpOnly and Secure. Everyone can see their sessions and end them, and sessions expire after 30 days without activity. Sign-up, sign-in links, password resets and public forms are protected by Cloudflare Turnstile and rate limits.

Eight roles decide what each person can see and do: owner, admin, finance, event management, booking, HR, read-only and staff in the portal. The same rules apply in the app and in the API. Individual events can be restricted to specific people, and staff in the portal only see their own shifts and hours.

Every database query is bound to one organisation. Automated checks run on every code change and make sure no query can read or change another organisation's data.

All traffic runs over HTTPS with HSTS. Cloudflare encrypts the database and files at rest.

On top of that, Evnty encrypts sensitive staff fields one by one with AES-256-GCM: address, tax ID, social security number, IBAN and emergency contact. The same applies to accounting API tokens such as the one for SevDesk. Reading sensitive staff fields needs its own permission, and every view is recorded.

Changes to finance, staff, time and permission data are logged with the person, the time and the request, in the same database step as the change itself.

Corrections to working time need a reason and go into a history that cannot be changed or deleted, secured by a SHA-256 hash chain. Closed payroll months stay locked. More under time tracking.

AI connections are off until an owner switches them on and decides whether only admins or all members may connect. Connecting requires two-factor authentication and a recent sign-in. Access uses OAuth 2.1 with short-lived tokens for one organisation.

Assistants only read what both the granted permissions and the member's role allow, through fixed field lists: no notes, contacts, staff, time, contract, file or accounting data. There are no tools that write. More under AI connections.

The database can be restored to any point in the last 30 days. Accounts can be deleted in the app. When an organisation closes, its data can be exported for 30 days before it is deleted. Deleted data can remain in locked backups for up to 30 days.

No tracking or advertising cookies. Web analytics only run with consent and set no cookies. Application logs contain no content, email addresses, IP addresses or tokens and are deleted after 7 days. Applications from public forms are deleted automatically after the retention period you set.

For the data your organisation manages in Evnty, your organisation is the controller and Evnty processes it on its behalf. We conclude a data processing agreement under Art. 28 GDPR with every organisation. The technical and organisational measures and the list of subprocessors are part of it. Ask for them at hallo@evnty.de.