Security FAQ
Version 1.0 – effective 27 Oct 2026
Who runs Eventyora? DYNAMIC BTL EVENTS SRL, Bucharest, Romania.
Where is the data stored? In the EU: with Romarg (Romania) today, and in DigitalOcean's EU region after our planned move. The list of providers is on the Subprocessors page.
Who is responsible for my guests' data? You are the controller, we are the processor. Our DPA explains it.
Can another organizer see my data? No. Each request is checked for organization and event, and we tested it with a second organizer account: every attempt was refused.
How are payments protected? Card details go to Netopia and are never stored by Eventyora. Payment confirmations from Netopia are verified by signature and amount.
Do you encrypt data? Connections use HTTPS. Secrets for integrations are encrypted. Personal data in the database and backups is not encrypted at field level yet; we rely on the host's protection and are planning it.
Do you have two-factor sign-in? Not yet for organizer accounts. It is planned. Use a strong, unique password and give people only the role they need (for example "check-in" for door staff).
Can I see who exported my guest list? Every download of a participant, report or payments list is recorded in our audit log (who, which event, when). On request we give you the entries for your events. Also limit the roles that can export (viewer, finance and check-in cannot download the participant list).
What roles exist? Owner, agency admin, organizer admin, client organizer, event manager, viewer, check-in, finance, DJ.
How do you protect tickets and door links? Random links and codes, not indexed by search engines, checked at every scan.
How do you protect email? A fixed sender with SPF, DKIM and DMARC set to reject, so nobody can send email as Eventyora. Organizers cannot change the sender.
What do you do about uploads? Images are checked and re-encoded; risky formats such as SVG are refused.
How do you test changes? Every release is reviewed by a critic, a break-tester and a security reviewer on a test copy with no real data first, with a rollback package.
How long do you keep data? See the Data Retention Policy. For example, answers of people who never paid are erased 30 days after the event.
What if there is a breach? We follow our written procedure: we tell affected organizers within 48 hours, and the authority and people when the law requires.
How do I delete my data or close my account? From your profile (delete account), or write to privacy@eventyora.com. Export first.
Do you use AI? The CRM has AI help features. They are used only when you use them, and only the text you submit is sent to the provider (OpenAI).
How do I report a vulnerability? Email privacy@eventyora.com (subject "Security"). Please do not test on live accounts without our written permission.
Do you have ISO 27001 or SOC 2? No. We can answer your security questionnaire.