Your meetings and contacts are yours. Only yours.
Exhibitor pipelines are commercially sensitive. EventsGO is built so that another company — or EventsGO staff — cannot see your data by default, and so that every sensitive action leaves a trace.
- Per-company data isolation (RLS)
- No standing staff access
- Role-based permissions
- Optional 2FA
- TLS + encryption at rest
- Audit trail
- GDPR / KVKK tooling
Isolation at the database layer
Every table that holds your data — meetings, contacts, events, configuration, email logs, user profiles — is scoped to your company by row-level security in PostgreSQL. It is enforced by the database, not just by the app, and server-side functions verify company membership again before acting.
- Row-level security on every company-scoped table
- Event-level access control on top of company scope
- Server-side re-checks in every privileged function
No standing access — not even us
EventsGO staff have no standing access to customer content. Support access to a workspace is approval-gated by your admin, time-boxed, and written to the audit log — so you can see exactly when, who and why.
- Approval-gated, time-boxed support access
- Every support session logged
- We do not sell or share your data
Roles and permissions
Access is role-based and least-privilege: a company admin manages the workspace, members work with meetings and contacts, and viewers get read-only access. Admins can tune what each role may do, and restrict people to specific events.
- Company admin / member / viewer roles
- Configurable per-role permissions
- Event-level membership
Authentication
Sign-in uses short-lived signed tokens (JWT) issued by the platform. Email/password or Google / Microsoft single sign-on, verified password reset, and optional two-factor authentication (TOTP) that any user can enable for their own account.
- Google & Microsoft SSO
- Optional TOTP two-factor authentication
- Verified email flows for reset and invites
Encryption and secrets
All traffic between browsers, the iOS app and our servers is encrypted in transit with TLS; the managed PostgreSQL database encrypts data at rest. Credentials are never stored in plain text, and integration keys you provide (e.g. Apollo, Lusha) are write-only — the app only ever sees a last-4 hint.
- TLS in transit, encryption at rest
- No plain-text credentials
- Write-only storage for customer API keys
Audit trail
Sensitive actions — logins, role and status changes, meeting changes, scoring updates, exports and configuration edits — are written to an audit log with the actor, timestamp and before/after values, viewable by your admins and exportable.
- Actor, timestamp, before/after on sensitive actions
- Viewable in the Admin panel
- Exportable
Privacy, GDPR and KVKK
We process only the data you put into the platform, for the purpose of running your events. Your admin can export everything at any time, action data-subject requests (permanent erasure), record consent, opt out of AI processing, and configure retention — from Admin → Privacy & GDPR.
- Export any time (CSV/Excel), no lock-in
- Data-subject erasure on request
- AI opt-out, consent capture, configurable retention
- Cookie consent gates non-essential monitoring
Subprocessors
The third parties that process data on our behalf, and why.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication & hosting | EU / US |
| Anthropic (Claude) | AI briefs, summaries, suggestions (opt-out available) | US |
| HubSpot | CRM sync — only if you connect it | US |
| Mailjet | Transactional & report email | EU |
| Sentry | Error monitoring (consent-gated in the web app) | US |
| Stripe | Billing & payments | US |
Reporting a security concern
If you believe you have found a security issue, contact us directly rather than disclosing it publicly — we take reports seriously and respond promptly. Need a security questionnaire completed for procurement? Same address.
support@eventsgo.coSecurity FAQ
How can we be sure our company data is hidden from other companies?
Isolation is enforced at the database layer, not just in the app. Every table that holds your data — meetings, contacts, events, configuration, email logs, user profiles — is protected by PostgreSQL Row-Level Security (RLS). Each request carries the signed-in user's identity, and the database itself only returns rows whose company_id matches that user's company. So even if a request were crafted to ask for another company's records, the database returns nothing — the rule lives below the application, so no application bug can quietly bypass it. One company can never see, edit or delete another company's data.
Who inside our own company can see what?
Access is role-based and least-privilege. A company admin manages the workspace, members work with meetings and contacts, and viewers get read-only access. Server-side functions additionally verify that the caller belongs to an active company before performing sensitive actions such as sending email.
Is our data encrypted?
Yes. All traffic between your browser/app and our servers is encrypted in transit with TLS (HTTPS), and the managed PostgreSQL database encrypts data at rest. Credentials are never stored in plain text.
How is sign-in secured?
Authentication uses short-lived signed tokens (JWT) issued by the platform. You can sign in with email/password or via Google / Microsoft single sign-on, and passwords can be reset through a verified email flow. Every API call must present a valid token tied to a real user.
Do you keep an audit trail?
Yes. Sensitive actions — logins, role and status changes, meeting changes, scoring updates, exports and configuration edits — are written to an audit log with the actor, timestamp and before/after values, visible to your administrators.
Where is our data hosted, and what about GDPR?
Data is stored in managed PostgreSQL infrastructure. We support data export and permanent deletion on request, and we only process the data you put into the platform for the purpose of running your events. For specific data-residency, processing-agreement or compliance requirements, contact us and we will work through them with you.
Can EventsGO staff read our data?
Access to production data is restricted and used only when strictly necessary to operate or support the service (for example, diagnosing an issue you report). We do not sell your data, and we do not share it beyond the sub-processors needed to deliver the service (database hosting, email and calendar providers).
How do we report a security concern?
If you believe you have found a security issue, please contact us directly rather than disclosing it publicly. We take reports seriously and respond promptly.
Built for teams that take their pipeline seriously
See every capability, or start with a plan.