ISO 27001-informed security

Our approach

• Risk-based. We identify risks to the confidentiality, integrity and availability of event and delegate data, and choose controls to match.
• Built in, not added on. Security checks run on the server for every request, not just in the browser.
• Continual improvement. We review our controls regularly, act on security scans and fix findings promptly.

Organisational controls

Policies, responsibilities and supplier oversight (Annex A.5).

Information security roles

Named responsibility for security within Pixel Takeaway Limited, with a single contact point for security matters.

Asset and data classification

Delegate, payment and organiser data are treated as confidential by default. Public event content is published only when an organiser chooses to.

Supplier security

Hosting, payments and email are provided by established processors. Each organisation can use its own payment and email accounts, so its data stays in accounts it controls.

Incident management

Application errors raise automatic alerts to our team, so problems are looked at promptly rather than discovered by customers.

Privacy and personal data

UK GDPR processes for access, correction, export and erasure requests are built into the product.

People controls

Awareness, confidentiality and responsibilities (Annex A.6).

Least-privilege staff roles

Organisation staff are given roles that match their job. Administrators decide which pages each role can open.

Capped system administrators

No more than three people can hold the system administrator role at any time.

Joiners and leavers

Staff are invited individually and access can be removed immediately when someone leaves.

Physical controls

Secure premises and equipment (Annex A.7).

Managed data centres

The platform runs on cloud infrastructure whose providers operate physically secured, independently audited data centres. We hold no customer data on office equipment.

Technological controls

Access, cryptography, secure development and monitoring (Annex A.8).

Strict organisation separation

Every staff action is checked on the server against the user's own organisation, and database rules stop one organisation from reading another's records.

Strong authentication

Staff accounts use multi-factor authentication. Organisations can also sign in through their own Microsoft Entra ID.

Encryption

All traffic is encrypted in transit with TLS. Data at rest is encrypted by our hosting provider, and integration secrets are stored separately from ordinary settings.

Protected files

Uploaded files sit in private storage and are only shared through short-lived, signed links.

Abuse prevention

Rate limits on sign-in, public forms and sensitive staff actions slow down automated attacks.

Secure development

Input is validated on the server, browser security headers restrict which scripts can run on staff pages, and dependencies are scanned for known vulnerabilities.

Logging and audit trail

Sensitive changes such as role updates, refunds and publishing are recorded in an organisation activity log.

Secure payments

Card details are entered directly with Stripe and never touch our servers. Payments are confirmed only by verified notifications from Stripe.

Shared responsibility

We secure the platform. Each organisation remains responsible for who it invites as staff, keeping their own integration keys safe and the content it publishes. We are happy to advise on good practice.

Related information

• UK GDPR and data protection
• Privacy notice
• Accessibility statement

Security questions and reports

For procurement questionnaires, more detail on our controls, or to report a possible vulnerability, email team@eventsbench.com. Please give us a reasonable chance to fix a reported issue before sharing it publicly.