Security at EventWorks

EventWorks handles event data, client details, and financial information for agencies, venues, and caterers across the UK. This page describes how we protect it.

Questions? Contact [email protected].

Infrastructure and hosting

EventWorks is hosted on infrastructure in the United Kingdom whose provider holds SOC 2 Type II and ISO 27001 certifications. All data at rest is encrypted, and all connections to the platform are encrypted in transit using TLS.

Network security

Our servers communicate over a zero-trust private network. Services are not exposed to the public internet beyond the endpoints that need to be: the web application, its API, and webhook receivers. Internal management interfaces, databases, and supporting services are reachable only through authenticated, encrypted tunnels between authorised machines.

Intrusion detection

Every server in the fleet runs a host-based intrusion detection agent that monitors for file integrity changes, rootkit signatures, unauthorised access attempts, and anomalous system behaviour. Alerts are forwarded to the operations team as they occur.

Vulnerability scanning

Automated vulnerability scanning checks operating system packages and application dependencies against known vulnerability databases continuously. Scanning is also integrated into the deployment pipeline, so known vulnerabilities are flagged before code reaches production.

Monitoring and alerting

Automated monitoring covers system health, application performance, and security events 24/7. Alerts fire on anomalies like resource exhaustion, error rate spikes, and failed authentication attempts, and route to the on-call team for investigation.

Patch management

Operating system and dependency updates follow a regular, automated cadence. Security patches are applied promptly, with critical vulnerabilities prioritised for same-day remediation. Servers reboot automatically after kernel updates so patches take effect straight away.

Backups

Application data is backed up automatically on a daily schedule. Backups are replicated to a geographically separate, offsite storage provider under object lock, which means backup data cannot be modified or deleted - even by us - for the duration of the retention period. This protects against ransomware and accidental deletion alike.

Application security

The platform sits behind a web application firewall and DDoS protection service that filters malicious traffic before it reaches our servers. User sessions are protected with secure, HTTP-only cookies, and sensitive operations require re-authentication.

Access control

Access to production infrastructure is restricted to a small number of named individuals on the engineering team, authenticated through the zero-trust network. There is no shared or anonymous access to production systems. Customer data access within the application is governed by the role-based permissions each customer's administrator configures for their own team.

Incident response

We have an incident response process covering identification, containment, eradication, and recovery. If a security incident affects customer data, we notify affected customers with details of what happened, what data was involved, and what we are doing about it. We aim to issue initial notification within 72 hours, in line with UK GDPR requirements.

Certifications

We are currently working toward Cyber Essentials certification, the UK government-backed scheme that covers firewalls, secure configuration, access control, malware protection, and patch management. We will update this page when certification is complete.

Our hosting infrastructure provider holds SOC 2 Type II and ISO 27001 certifications independently.

Responsible disclosure

If you believe you have found a security vulnerability in EventWorks, please report it to [email protected]. We ask that you give us reasonable time to investigate and address the issue before any public disclosure.