Security, in specifics rather than adjectives.
You are handing us your attendees’ names, their payments and the list of who is allowed in. Here is exactly how that is protected.
Encrypted on the way, and encrypted at rest.
All data transmitted to and from Alltix is protected using industry-standard encryption protocols.
In transit
- TLS 1.3 encryption for all web traffic and API communications
- HTTPS enforced across all domains and subdomains
- Secure WebSocket connections for real-time features
- Certificate pinning for mobile applications
At rest
- AES-256 encryption for stored data
- Encrypted database backups
- Secure key management with regular rotation
- Sensitive fields additionally encrypted at application level
Built on infrastructure that assumes something will go wrong.
Our infrastructure is built on enterprise-grade cloud platforms with multiple layers of protection.
- Network isolation with virtual private clouds
- Web application firewall protection
- DDoS mitigation and traffic filtering
- Regular security patches and system updates
- Redundant systems across multiple availability zones
- Automated backups with geographic distribution
Only the people who need your data can reach it.
Your account
- Secure password hashing using bcrypt
- Multi-factor authentication available
- Session management with secure tokens
- Automatic session timeout when inactive
- Account lockout after failed login attempts
Our people
- Role-based access control across all systems
- Principle of least privilege enforced
- Access reviews conducted regularly
- Audit logging of all administrative actions
We never hold a full card number.
Payment processing is handled through PCI DSS compliant systems. Alltix never stores full credit card numbers.
- PCI DSS compliant payment processing
- Tokenisation of payment credentials
- 3D Secure authentication support
- Fraud detection and prevention systems
- Secure checkout over HTTPS
Watched continuously, not reviewed occasionally.
Continuous monitoring helps us detect and respond to potential security threats quickly.
- 24/7 system monitoring and alerting
- Intrusion detection systems
- Anomaly detection for unusual activity patterns
- Real-time log analysis and correlation
- Automated vulnerability scanning
- Regular penetration testing by third parties
The attendee data is the organizer's, not ours.
Retention
- Data kept only as long as needed for operations or law
- Event organizers own their attendee data
Deletion
- Deletion can be requested and is honoured once verified
- Backups purged according to retention schedules
Third parties
- Data shared only where needed to deliver the service
- All vendors vetted for security practices
A documented plan, not an improvised one.
If user data is ever affected by a breach, we notify the affected parties in accordance with applicable law.
Detection
Automated monitoring identifies potential incidents.
Response
The security team investigates and contains the threat.
Recovery
Systems are restored and the lessons documented.
The standards we hold ourselves to.
- PCI DSS
- Payment card security
- GDPR ready
- EU data protection
- CCPA ready
- California privacy
- HTTPS everywhere
- Secure connections
- AES-256
- Data encryption standard
A few things that are down to you.
- Use a strong, unique password for your Alltix account
- Turn on multi-factor authentication
- Never share your login credentials
- Log out of shared or public computers
- Keep your email address current for security notices
- Report anything suspicious immediately
- Be wary of phishing emails claiming to be from Alltix
- Check you are on alltix.co before entering credentials
Found something? Tell us.
If you discover a security vulnerability or have a security-related concern, contact us at support@alltix.co with the subject line “Security Report”.
We appreciate researchers who disclose responsibly. Please include enough detail to reproduce the issue, and allow us reasonable time to address it before disclosing publicly.