Security
Built for events you can't afford to lose.
Attendee data is the most sensitive asset of a professional event. eventOz treats it that way — architecturally, not as a checklist.
01 · Tenant isolation
Your event's data is not one ID guess away from anyone else's.
- Every request is validated server-side: user → organization membership → event membership → requested resource
- Queries are always scoped by organization — a plain “WHERE id = …” never happens
- Manipulated attendee, session or booking IDs fail with 403 or 404
- PocketBase API rules plus Go-level permission checks enforce the same model twice
- Automated security tests probe cross-tenant access on every critical collection
02 · Access control
Roles that match how event teams actually work.
- Organization roles: Owner, Admin, Member
- Event roles: Admin, Program, Communication, Check-in, Analyst
- One person can be Owner in one organization and Check-in staff on another — roles are per context, never global
- Every check-in stores who checked in, when, and on which device
03 · Data protection
Secrets stay on the server. Yours and your attendees'.
- SMTP credentials are encrypted at rest — never returned by the API, never logged, never sent to analytics
- Attendee QR codes carry a signed token, never personal data in plain text
- Magic links are event-bound: a token from one event can't open another
- Every privileged action is written to an audit log (who, what, when)
- GDPR-ready data handling, EU hosting available
- Structured logging with a hard rule: no passwords, no tokens, no secrets, no unnecessary personal data
04 · Reliability
Fast under load, calm under pressure.
- Designed for event-day load: at least 1,000 concurrent attendees per event, critical views in under a second
- Realtime via server-sent events with targeted, permission-checked subscriptions
- Persistent e-mail queue with retries — logins and confirmations don't get lost
- Error tracking and structured logs on the server — without leaking secrets
Security through simplicity: eventOz runs as one Go binary with a SQLite database behind Cloudflare — no sprawling service landscape, few moving parts, every part accounted for.
Explore the product →