Security

Overview

This page summarizes the safeguards we use to protect customer data. It is intended as a practical overview for customers, procurement teams, counsel, and security reviewers. A signed customer agreement, data processing addendum, or security exhibit may include additional commitments for a covered account.

We describe controls at a useful level without overstating guarantees. No internet service can promise perfect security, and no event operations platform can remove every operational risk from a live event.

Shared Responsibility

Fomatic protects the application, infrastructure configuration, private file access paths, access-control model, audit trails, and vendor relationships that support the service. Customers remain responsible for deciding what information belongs in Fomatic, inviting the right people, assigning appropriate roles, reviewing access, configuring integrations, and training users.

Access Control

• Authenticated workspaces are protected by login and session controls.
• People can sign in with a password, a one-time email link, a passkey, or a Google or Microsoft account, and add a second factor with an authenticator app or a passkey. An organization can require a second factor for its admins or for everyone.
• An organization can sign its team and attendees in through its own identity provider with OpenID Connect single sign-on, and require it for everyone at a domain it has verified, apart from its owners.
• Customer data is scoped by organization and event, with role-based access for admins, coordinators, viewers, volunteers, staff, sponsor contacts, and internal platform operators.
• Sponsor portal access is limited through invitation, sponsor-specific context, and sponsor-specific permissions.
• Sensitive staff and platform routes require staff-role checks in addition to normal authentication.
• Customers can reduce risk by using least-privilege access and removing people who no longer need event or sponsor access.

Application Safeguards

• Event and organization writes are designed to run through authorized server actions and service-layer checks.
• Public routes are explicitly allow-listed; authenticated application routes are protected by default.
• Customer data access is designed around organization, event, sponsor, staff-role, and portal boundaries.
• Uploaded files use private storage paths and controlled download or rendering routes rather than unrestricted public URLs.
• Service code is structured around authorization checks, validation, service-layer business logic, and audit logging for important operational changes.

Infrastructure and Data Protection

• Fomatic uses reputable cloud providers for application hosting, database infrastructure, private file storage, email delivery, and related operational services.
• Network traffic is protected with HTTPS in production.
• Customer data is encrypted at rest in the database and in file storage.
• Production security headers restrict framing, object embedding, and other browser behaviors that commonly create web security risk.
• Customer files are stored in private buckets and accessed through controlled application paths.
• The database is backed up every hour, and each backup is kept for 14 days.

Boon and Translation

• Boon, the assistant for event teams, suggests changes, and a person approves each one before it takes effect. An organization's owner can turn Boon off.
• Machine translation is off for a new organization until its owner turns it on. Translating attendees' typed answers has its own switch.

Vendors and Integrations

We review subprocessors and integration providers based on the service they provide, the type of data they process, and their relevance to Fomatic. Our current public list is available on the Subprocessors page.

Customer-enabled integrations, such as QuickBooks, CRM/webhook destinations, email workflows, analytics, and AI-assisted features, process data when a customer connects, configures, enables, or uses that integration. Those third-party services are also governed by their own terms and privacy practices.

Logging, Audit, and Monitoring

• Audit logs record important account, event, sponsor, billing, import, export, and operational changes.
• Security and operational logs help us investigate errors, suspicious activity, denied access, integration delivery, rate limits, and service health.
• Logs are used to secure and operate the service, support customers, troubleshoot incidents, and satisfy legitimate business, legal, and audit needs.

Incident Response

If we confirm a breach of a customer's data, we tell that customer within 48 hours of becoming aware of it, and keep them updated as we learn more. We investigate, take reasonable steps to contain and remediate it, and notify anyone else applicable law and customer agreements require.

Customers should promptly report suspected unauthorized access, credential compromise, suspicious event exports, or integration misconfiguration so we can investigate with the right context.

Customer Responsibilities

• Use strong passwords and protect account credentials.
• Promptly remove users who no longer need access.
• Review sponsor portal contacts, staff invitations, platform roles, and event roles before sharing live event data.
• Avoid entering sensitive information that is not necessary to run the event.
• Review customer-enabled integrations before syncing event, sponsor, attendee, invoice, or CRM data to third-party systems.
• Maintain appropriate privacy notices, permissions, consents, and lawful bases for the event data customers provide to Fomatic.

Security Questions and Reports

Questions about Fomatic security, vendor review, or responsible vulnerability reporting can be sent to security@fomaticevents.com.

Security commitments for a specific customer account may also be documented in an order form, DPA, security exhibit, or other written customer agreement.