Security at Eventra

Eventra is served over HTTPS only. Plain HTTP requests are redirected, certificates are issued and renewed automatically, and browsers are told to keep using HTTPS through the Strict-Transport-Security header.

• Passwords are hashed with bcrypt and never stored in plain text.
• A session is a long random token. The browser cookie is HttpOnly, SameSite and marked Secure in production, and a session expires after 30 days.
• Invite links are single-purpose tokens that are stored as hashes and expire after 3 days.
• Sign-up, sign-in and event ingestion are rate limited to slow down abuse.
• Signing in with Google or GitHub uses the standard authorization code flow with PKCE and a one-time state check. We accept a provider's email address only when the provider has verified it, and we never receive your password for that provider.

Every request is checked on the server against your account, your workspace role (owner, admin or member) and, for members, the projects you were explicitly added to. Hiding something in the interface is never the only protection.

An event sent with one project's API key can only ever be written to that project.

• Keys belong to a single project and cannot read or write anything outside it.
• Keys are stored as hashes. We can verify a key, but we cannot show it to you again.
• Keys can be revoked at any time and stop working immediately.
• Keep keys out of public repositories and public client-side code you do not control.

Eventra stores feature names, an optional user ID, optional properties and a timestamp. It does not need names, emails or any other personal data about your end users, so please do not send them. Use an internal or hashed user ID instead.

Raw events are kept for a rolling 12-month window. Older raw data is deleted automatically.

Production runs on a DigitalOcean server in Amsterdam (Netherlands). The database and cache are not exposed to the internet; only the web entry point accepts outside connections. Each service runs in its own container with memory limits, and services restart automatically after a failure.

Transactional email (verification, password reset, usage alerts) is sent through Resend.

If you believe you found a vulnerability, please email us with the steps to reproduce it. We read every report. Please give us a reasonable chance to fix the issue before you disclose it publicly, and do not access or change data that is not yours.