How we protect event and guest data
Security is designed into access, storage, payments and day-to-day operations, with controls appropriate to the sensitivity of event data.
1. Security approach
InviApp applies layered technical and organisational safeguards and reviews them as the product and threat landscape change. No online service can guarantee absolute security, so controls focus on reducing likelihood and impact.
2. Identity and access
Account sessions use authenticated access controls. Private-event data is restricted to authorised hosts and recognised guests. Guest-specific actions use personal links or codes and are checked on the server rather than trusted from the browser. Administrative access is limited by role and operational need.
3. Data and media protection
Connections use HTTPS encryption in transit. Database permissions and row-level rules limit access by account and event. Uploaded media is served through controlled storage and delivery paths rather than exposing storage credentials.
4. Payments
Card payments are processed by Stripe. InviApp does not store full payment-card numbers. Invoice billing records are limited to information needed for the transaction, accounting and tax.
5. Secure operations
We use dependency review, logging, backups, least-privilege access and monitoring to identify operational and security problems. Sensitive credentials are kept outside application source code and rotated when needed.
6. Incident response
Suspected incidents are assessed, contained and remediated. Affected customers and authorities are notified when applicable law requires it. Service availability information is published at status.inviapp.com.
7. Responsible disclosure
If you believe you found a vulnerability, email alex@inviapp.com with a clear description and steps to reproduce it. Please avoid accessing other people’s data, disrupting the service or publicly disclosing the issue before we can investigate.
Contact: alex@inviapp.com