The answers your IT team will ask for.

In data centres in the European Union, and the backups stay there too. Attendee data does not leave the EU unless you connect a service outside it yourself.

No. Every request is limited to your own records by the database itself, beneath the application, so a mistake in a screen cannot show one organizer another's people, companies or numbers. Tests of those database rules run before every release.

Only the platform staff who need to, when you ask for support, and every administrative action is recorded in an audit log you can read.

With a password stored only as a one-way hash. Attendees can also sign in through your own identity provider over SAML 2.0; OpenID Connect, and single sign-on for organizers, are coming. Organizers, exhibitors and attendees each sign in to their own product, and a sign-in for one never opens another.

No. Card details go straight to your payment provider. ConferOS keeps the payment reference, the amount and the status, and never holds the money.

Every connection uses HTTPS. The keys that sign sessions, protect stored settings and sign ticket codes are separate from one another, so none of them can stand in for another.

For as long as you decide, within limits the platform sets. Each organizer chooses its retention periods, counted from the end of each event, and is told before anything is removed. Attendees can ask for their own data to be erased at any time.

Yes. We sign one with every organizer before its first event, and the list of sub-processors is part of it.

From your own mail server once you add it in your settings, so attendees and exhibitors see your name on everything they receive.

Write to contact@conferos.eu with "Security" in the subject line.