Security

Last updated 2026-08-05

sbTix runs the payments and personal data of thousands of attendees a week. This page describes how we protect that data, and how you can report a security issue if you find one.

Encryption

In transit

• TLS 1.2+ everywhere. HSTS enabled at the domain level.
• HTTP/2 + secure headers (CSP, X-Content-Type-Options, Referrer-Policy).
• Ticket QR codes are HMAC-SHA256 signed with a rotating platform secret — forgeries are rejected at the door.

At rest

• All customer data is encrypted at rest with AES-256 on SOC 2 Type II + ISO 27001 certified infrastructure.
• Passwords are hashed with PBKDF2 (SHA-256, 100,000 iterations, per-user salt) via WebCrypto — never stored in plaintext.
• Session tokens live in HttpOnly + Secure + SameSite=Lax cookies. Never in localStorage. Never in URL parameters (except one-time magic-login tokens that are single-use and expire in 7 days).
• Payment cards are never stored on our systems — payment processing is handled by a PCI DSS Level 1 processor.

Authentication and access

• 2-factor authentication is available (email TOTP). Mandatory for platform administrators.
• Sessions expire; users can sign out from all devices.
• Role-based access control per organization — owner, manager, team manager, scanner, viewer, plus the platform-level admin and support roles.
• Support access uses a Bank-of-America-style consent flow: a customer generates a code, shares it with support, and we can only see their data while the code is active. Every support action is logged.

Tenant isolation

sbTix is multi-tenant. Every mutation checks that the caller is a member of the organization they're acting on, at the database query layer (WHERE org_id = ?), the cache layer (tenant-prefixed keys), and the log layer (redaction). Automated tests exercise cross-tenant access attempts on every deploy.

Infrastructure

• Hosted on enterprise-grade cloud infrastructure — SOC 2 Type II, ISO 27001, PCI DSS certified. Named provider disclosed in our DPA under NDA.
• Payments handled by a PCI DSS Level 1 + SOC 1/2 Type II payment processor.
• Transactional email delivered through a SOC 2 Type II provider.
• Sub-processor categories are summarized on our Trust page; the full named list is provided in our DPA under NDA.

Network defense

• WAF at the edge — Managed Ruleset + OWASP Core.
• Per-endpoint rate limits — 5/min for auth, 60/min for mutations, 300/min for reads.
• Bot management enabled.
• Edge DDoS protection.

Audit and monitoring

• Every mutation writes to an append-only admin_audit log — who, what, when, from where.
• Error monitoring with correlation IDs. Personally identifiable information is redacted from structured logs.
• Public status transparency will land at status.sbtix.net (in development).

Incident response

• Every incident produces a written 5-field post-mortem within 48 hours: what happened, impact, root cause, blast radius, and what prevents it next time.
• Breach notification to affected users within 72 hours per GDPR Article 33 when applicable.
• Prevention items open as tracked engineering tasks before the incident is closed.

Vulnerability disclosure policy

If you find a security issue in sbTix, please email [email protected] with:

• A description of the issue
• Steps to reproduce
• The affected URL(s) or endpoint(s)
• Your contact info for follow-up

Our commitments to you

• Acknowledge receipt within 48 hours.
• Provide an initial assessment within 5 business days.
• Keep you updated on remediation progress.
• Credit you publicly on our acknowledgements page (with your permission) once the issue is resolved.
• Not pursue legal action for good-faith research that follows the guidelines below.

Guidelines for research

• Test only against your own accounts or test accounts you create.
• Do not access, modify, or delete data belonging to other users.
• Do not run automated scans that impact service availability.
• Do not publicly disclose the issue before we've had reasonable time to fix (typically 90 days).
• Report through [email protected] — not public channels — until we've patched.

We do not currently run a paid bug-bounty program, but we always credit good research on the acknowledgements page.

Compliance posture

• GDPR — data-subject rights endpoints available. Data processing agreement on request.
• CCPA — same access + deletion rights applied to California residents.
• SOC 2 Type II — targeting Q4 2026. Readiness assessment available to prospects under NDA.
• HIPAA — Business Associate Agreement available on Enterprise tier when the product line requires it.
• EU AI Act — AI-assisted content is labeled; model registry maintained.
• See the full pre-answered security questionnaire (CAIQ v4) on our Trust page.