Trust & Safety

Security

We take the security of your data and events seriously. Here's an overview of the measures we have in place.

Authentication

  • ✓Passwords hashed with bcrypt (cost factor 12)
  • ✓JWT access tokens expire in 15 minutes
  • ✓Refresh token rotation on every use — stolen tokens are invalidated
  • ✓Google OAuth 2.0 social login
  • ✓Brute-force protection via rate limiting (express-rate-limit)

Infrastructure

  • ✓TLS 1.3 for all data in transit (Vercel + Railway)
  • ✓HTTP security headers via Helmet.js (CSP, HSTS, X-Frame-Options)
  • ✓CORS policy restricts origins to approved domains
  • ✓MongoDB Atlas with IP allowlist and encrypted storage
  • ✓Redis sessions in Upstash (encrypted at rest)

Application Security

  • ✓Input validation and sanitization on all API endpoints (express-validator + Zod)
  • ✓SQL/NoSQL injection prevention via Mongoose parameterised queries
  • ✓RBAC (role-based access control) enforced server-side on every route
  • ✓File upload validation — type and size limits enforced
  • ✓No sensitive data in client-side localStorage

Responsible Disclosure

If you discover a security vulnerability in EventOS Online, please report it responsibly. Do not exploit it or share it publicly before we have had a chance to investigate and patch it. We will acknowledge your report within 48 hours and keep you updated on our progress.

security@eventosonline.xyz