Security

1. Infrastructure#

• The application runs on Vercel, and the database, authentication and files on Supabase (AWS, us-west-2 region), providers with their own security programs and certifications.
• All traffic is encrypted with HTTPS (TLS); the site enforces HTTPS with HSTS. Data in the database and in storage is encrypted at rest by the provider.
• Keys and secrets are stored as server environment variables and are never sent to the browser.

2. Access control#

• Accounts: passwords are stored only as an irreversible hash (Supabase Auth). Sessions use signed tokens that expire and are renewed.
• Data isolation: the database enforces row-level security (RLS): each query can only see the events of the workspaces you belong to, with roles (owner, administrator, editor, viewer…).
• Every endpoint declares who can use it (user, event member with a role, staff with a PIN, public with a documented reason), and a suite of automated tests prevents endpoints from being added without that declaration.
• Personal invitations: they are opened with a link containing a long random token that is, in practice, impossible to guess.
• Access QR codes: cryptographically signed (HMAC), so that they cannot be forged.
• Door staff: they sign in with a numeric PIN per event, with a limit on attempts, and receive temporary access for 12 hours.
• Passly staff: minimal access, and only when necessary for support, security or legal compliance.

3. Application security#

• Attempt limits (rate limiting) on sign-in, RSVP, uploads and other sensitive points, to curb abuse and brute-force attacks.
• Security headers: content security policy (CSP), protection against the site being framed (clickjacking), nosniff, a strict referrer policy and a permissions policy.
• Validation of all data reaching the API and protection against automated submissions on public forms.
• Files: gallery photos and event documents are stored in private storage and served through signed temporary links. Uploads have size and type limits, and we strip location metadata (GPS) from photos.
• Payments: card data is processed exclusively by Stripe (PCI DSS Level 1 certified); it never passes through our servers. Stripe notifications are verified by signature.
• Logs: we log technical and security events without storing emails, phone numbers, health data or tokens; IP addresses are stored only as a non-reversible encrypted code.

4. Privacy by design#

• Invitations do not load third-party analytics; the map and the music connect to third parties only if the guest turns them on.
• AI features that handle personal data use a provider that does not train on that data, and results containing guest data are not cached.
• Daily automatic purges according to the Retention Policy.

5. Incident management#

If we detect a security breach affecting personal data, we contain it, investigate its scope and notify, without undue delay, the affected hosts, the affected individuals when their risk warrants it and the authorities when the law requires it (in the EU, within a maximum of 72 hours).

6. Reporting a vulnerability#

If you find a vulnerability, write to us at [PENDIENTE: Correo de seguridad (p. ej. seguridad@wepassly.com)] with the steps to reproduce it. We ask that you do not access other people's data beyond the minimum needed to demonstrate it, that you do not affect the availability of the service and that you give us a reasonable period to fix it before publishing it. We will not take legal action against anyone who researches in good faith following these rules. Our security.txt file contains this information in a standard format.

7. Your part#

Use a long and unique password, do not share your account, share the staff PIN only with your door team, remove access for anyone who no longer works with you and sign out on shared devices (Settings → Security → “Sign out of all devices” (Ajustes → Seguridad → «Cerrar sesión en todos los dispositivos»)).