Security & Safety | Eventboost

COMPANY

Security & Safety

Last updated: 11 February 2026

1. Purpose

Eventboost prioritizes information security and data protection. This page outlines our main organizational and technical measures and should be read together with our:

Privacy Policy (Controller processing)
DPA / Data Processing Agreement (Processor processing for Organizers)
Cookies Policy

2. Privacy governance and internal culture

We maintain policies and procedures supporting a privacy and security management program, including:

internal awareness and training;
least-privilege access controls;
supplier due diligence and contractual safeguards.

Important note: Eventboost does not sell personal data and does not share personal data with third parties for third-party marketing purposes. We may share data with service providers acting on our behalf to deliver the Services, under appropriate contractual and security controls.

3. ISO/IEC 27001 Certification

Eventboost has achieved ISO/IEC 27001:2022 certification for its Information Security Management System (ISMS).

The certification covers the design, development, maintenance, delivery and support of the Eventboost Software as a Service (SaaS) platform and related digital event services.

The certification has been issued by Scandinavian Certification AS and is valid until 28 August 2029.

Our ISMS provides a structured framework for:

information security governance
risk management
continuous improvement
supplier management
business continuity
incident management
access control
secure software development

Download ISO/IEC 27001 Certificate (PDF)

4. People controls and confidentiality

onboarding checks where applicable;
confidentiality obligations and internal policies;
role-based access, authentication and logging.

5. Infrastructure / production environment

Eventboost production systems are hosted on Amazon EC2 (AWS). The hosting environment relies on provider security assurances and audits, including (as stated by the provider):

PCI-DSS Level 1 Service Provider
ISO 27001
independent audits/assessments
SAS-70 Type II / SSAE16 (as applicable to historical provider attestations)

6. Application security (Web & Mobile)

web platform and mobile apps are developed and maintained by our internal engineering team;
encryption keys are restricted to the smallest feasible number of authorized personnel;
secure standard protocols such as AES and SSL/TLS are used for encryption and secure transport;
payment card data is handled under security standards: card data is not stored after transaction and is not stored on mobile devices.

7. Encryption and secure transmission

SSL/TLS is used to protect sensitive information in transit;
encryption is applied during data transmission between systems where applicable;
website and APIs are accessible via a 256-bit SSL certificate issued by DigiCert.

8. Operational security

We implement operational measures aimed at preventing, detecting and responding to security events, including:

security logging and monitoring;
backups and business continuity controls;
patching and vulnerability management;
protection against unauthorized access.

9. Incident response and data breaches

If a security incident involves personal data:

where Eventboost acts as Controller, we assess and comply with applicable legal obligations;
where Eventboost acts as Processor on an Organizer’s behalf, we notify the Organizer without undue delay in accordance with the DPA.