Security
Designed with security and compliance readiness in mind
EventOpsly implements architecture-level security controls for multi-tenant event operations. We do not claim certifications (such as SOC 2 or ISO 27001) unless independently achieved.
Multi-tenant architecture
- Organization-scoped data isolation at the application layer
- PostgreSQL Row Level Security (RLS) policies
- TenantService and EventScopeService for request scoping
Access control
- Role-based access control (RBAC) with scoped permissions
- Event-level permission enforcement
- HttpOnly cookie authentication with BFF pattern
- CSRF protection on mutating requests
Data protection
- Encrypted integration credentials at rest
- Opaque QR credential tokens with hashed storage
- Audit logging for sensitive operations
- Rate limiting on authentication and public endpoints
Integration security
- OAuth 2.0 with PKCE for provider connections
- HMAC-signed customer webhook delivery
- Signed webhook payload verification architecture
- Asynchronous dispatch via transactional outbox
Infrastructure
- AWS-hosted production environment (ECS, ALB, CloudFront, Route53)
- TLS encryption in transit
- Secrets Manager architecture for credential storage
- PostgreSQL, Redis, and SQS in production architecture
- Security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy
For security inquiries, contact security@eventopsly.com or support@eventopsly.com.