Security at Evnts
Your guests trust you with their phone numbers, and some with their money. Here's how we look after both.
No passwords to steal
Hosts and guests sign in by proving a mobile number with a one-time code or a link we text them. There are no passwords to leak or reuse. Sessions are signed, expire, and you can sign out of every device from your account. Links we send guests are signed too, so nobody can open or change someone else's RSVP.
Payments never touch our servers
Ticket payments run on Stripe's own checkout page, and the money goes to the host's Stripe account. We never see or store card numbers. Stripe is certified to PCI DSS Level 1, the highest level for card payments.
Where your data lives
Evnts runs on Cloudflare: the app, its database and uploaded images. Data is encrypted on its way to us (HTTPS everywhere, with HSTS) and encrypted where it's stored. Cloudflare holds SOC 2 Type II, ISO 27001 and PCI DSS certifications for the infrastructure we run on.
We keep as little as we can
We ask for a name and a mobile number, and an email only where it's needed for a receipt. We don't sell your data or use it to target ads, and there are no ad trackers on Evnts. You can download everything we hold on your number, or delete it, from your account at any time.
Every change that touches money or sign-in is checked first
Before a feature that handles payments, sign-in or personal data goes live, we review it against a written threat model. A second, independent reviewer checks each finding before it counts. Every fix ships with a test, so the same problem can't quietly come back, and every finding is tracked until it's closed.
Our security record
- 37 security reviews since September 2026 · last one 1 November 2026
- 314 issues found and fixed (44 serious, 270 minor)
- 0 serious issues open (always 0 before a release ships)
Uptime
We check the app every five minutes and post incidents on our status page: status.evnts.rsvp.
The services we use
| Service | What it does for us | What it receives |
|---|---|---|
| Cloudflare | Hosting, database, file storage, email sending, bot checks, invite images | Everything the app stores |
| Stripe | Ticket payments and payouts to hosts | Ticket details, and the payer's name, email and phone on its own checkout page |
| Telnyx | Text messages and WhatsApp | The mobile number and the message |
| Resend | Backup email sending | The email address and the message |
| Anthropic | Writes the first draft of an invite from the host's description | The text the host types |
| Address search and time zones when a host picks a venue | The address text the host types | |
| Open-Meteo | The weather forecast on an invite | The event's town and date |
Found a problem?
Email security@evnts.rsvp. We read every report and reply within five working days. Please read our disclosure policy first; we won't take action against research done in good faith.
Disclosure policy
We welcome reports. If you think you've found a security problem in Evnts, tell us at security@evnts.rsvp and give us a fair chance to fix it before telling anyone else.
Please:
- Test only against your own account and your own events, and never access, change or delete other people's data.
- Stop and tell us as soon as you reach data that isn't yours.
- Give us 90 days to fix the problem before you share details publicly.
Out of scope: denial-of-service or load testing, spam or sending messages to numbers you don't own, social engineering or phishing of anyone, physical attacks, and reports from automated scanners without a working example.
Our promise: if you follow this policy, we won't take legal action against you or ask anyone else to, we'll work with you to understand and fix the problem, and with your permission we'll thank you by name when it's fixed. We don't pay bounties yet.