Team and Security

Hand Out Access. Take It Back.

Two roles, sign-in by emailed link or Google with no passwords to leak, and door staff on a link and a four-digit PIN instead of an account. Pause the link, and every phone on it stops.

Start Your Free Trial Book a Demo

No passwords, for anyone
Door staff never need an account
Support sessions end after 60 minutes

Check-in settings for door staff: a four digit staff PIN, a switch to pause access, and a check-in link with a QR code to open on a phone. The PIN and link are masked in this image

2: Roles: Owner and Member; Read-only and finance roles are coming soon.
0: Passwords to Leak; Sign-in is an emailed link or Google.
1: Live Session per Person; Signing in somewhere new ends the old one.
60: Minute Cap on Support Sessions; Every session start is logged.

Roles

The Buttons That Really Hurt. Belong to One Person.

There are two roles, and the buttons that can really hurt sit with your owner. Everyone else gets on with running events.

The owner keeps the keys: billing, members, domains, event deletion, refunds and attendee erasure
Members run the events: build, edit and publish them, export data, run check-in, connect Stripe and update organisation details and VAT
Seats that follow your team: add or remove people whenever you like, and billing is pro-rated
Several organisations, one login: switch from the profile menu, so agencies keep each client in its own

Actions for one attendee: view the transaction, resend the confirmation email, edit registration details, print a badge, cancel and refund, or erase personal data

Sign-in

No Passwords to Leak. Not for Anyone.

Your team signs in with a link sent to their email, or with Google. Each link works once, expires after 60 minutes and opens only in the browser that asked for it, and signing in somewhere new ends the old session.

Browser check-in on a phone width screen: the event banner and a field where door staff enter the staff PIN to start checking people in — Door Staff A link and a four-digit PIN: 12 hours of check-in for one event, and no account.

Event app sign in screen on a phone offering a sign in link by email or a ticket code — Attendees A link to the inbox their ticket went to, or their ticket code.

Specs

Short Answers. For the Questionnaire.

Copy them straight into the spreadsheet your procurement team sent over.

Question	Answer
Roles	Owner and memberA former owner shows as Admin, with a member's rights.
Sign-in	Emailed one-time link or GoogleNo passwords.
Where Your Team Signs In	app.eventcloud.io, or your own eventcloud address once claimed
Attendee Sign-in	Emailed link to the attendee portalNo attendee passwords either.
Sessions	One live session per person, seven days at mostRemove someone and their session ends on the spot, in the website editor too.
Door Staff	A link and a four-digit PIN, 12 hours, one eventPause or rotate the link to end every session on it.
Data Isolation	Every query scoped to your organisationEvery record carries the organisation it belongs to.
Rate Limits	Counted in the databaseA redeploy does not reset anyone's count.
Browser Protections	A nonce-based content security policy, and HSTS with preload
Stripe	We never store an access token to your accountEvery Stripe message we receive is signature-checked and de-duplicated.
Hosting	United States, one region (US East)Cloudflare in front of every address we serve.
Support Access	Sessions end after 60 minutes, and every start is loggedSupport never sees billing details.
Audit Log	Membership, ownership, domains, subscription, support access and erasure
Attendee Erasure	On request, by the ownerLeads exhibitors captured from them go too; waiting-list sign-ups are held separately.
Consent Records	Each buyer's acceptance, with the exact wording they sawWhen you make the Terms and Policies agreement required.
Data After a Lapse	Kept for 30 days, with a warning seven days before deletion
Rehearsals	Stripe test cards, and test check-in on a draft eventTest tickets are flagged at the door.

On the Workbench

Multi-factor Sign-inA second factor on every sign-inComing Soon
Single Sign-onSet up by your ownerComing Soon
Read-only and Finance RolesLook without touching; reconcile without running eventsComing Soon
Audit Trail in the DashboardReadable by your ownerComing Soon
UK or EU HostingYour data in the region you chooseComing Soon
Data Processing AgreementA DPA you sign with usComing Soon
Accessibility StatementWhere eventcloud stands on accessibility, publishedComing Soon

The legal detail is in our GDPR policy and privacy policy. Buying for a large organisation or an agency? Read about Enterprise arrangements.

FAQ

Security Questions. Answered Before the Call.

The questions IT and legal ask first, with the answers we would give on the call.

How is eventcloud's security built?

Data is scoped to your organisation on every query, rate limits are kept in the database, sign-in links are single use, pages run a nonce-based content security policy, and support sessions end after 60 minutes with every session start logged.

Where is our data hosted?

Coming soon: UK or EU hosting, with a data processing agreement. Today your data is hosted in the United States, in a single region, with Cloudflare in front of every address we serve.

Can we give a colleague read-only access?

Coming soon: read-only and finance roles. Today there are two roles: the owner, who holds billing, members, domains, event deletion, refunds and attendee erasure, and members, who run events. Door staff never need an account; they check people in with a link and a four-digit PIN.

Do you offer multi-factor sign-in or single sign-on?

Coming soon: both. Today every sign-in is a one-time link sent to the person's email, or their Google account. There are no passwords, a link works once and only in the browser that asked for it, and each person has one live session at a time.

Can eventcloud staff see our data?

When our support team works inside your organisation, it uses a session that ends after 60 minutes, and every session start is logged. Support sees your events and attendees as a member would, and never sees your billing details.

Do door staff need their own accounts?

No. Share the event's check-in link and its four-digit PIN, and staff get 12 hours of check-in for that event only. Pause the link and every phone on it stops at once; a new PIN alone does not sign out phones already in, so pause first.

Keep Going

Feature
Data and Exports
What leaves eventcloud, in which format, and what happens after a lapse.
Feature
Check-in
Door staff on a link and a PIN, with no accounts to manage.
Feature
Branding and Custom Domains
Your address and sending domain, both kept by the owner.
Solution
Corporate Event Teams
Registration for teams who answer to IT and legal.
Solution
PCOs and Agencies
Keep every client in its own organisation.
Comparison
eventcloud vs Cvent
Where each one fits, side by side.

The Same Security. On Every Seat.

Unlimited events, registrations and attendees on every plan. Passwordless sign-in, organisation scoping and door staff without accounts come with every seat.