How Eventops protects your data and how to report vulnerabilities.
Eventops is served exclusively over HTTPS with HTTP Strict Transport Security (HSTS), strict content-type and framing protections, a restrictive Content Security Policy, and cross-origin isolation headers. Authentication is session-based with encrypted credential storage; passwords are never stored in plain text.
Accounts are provisioned by administrators only — no public sign-up. Role-based access control and row-level security policies ensure users can only access data they are authorized to see. Administrative actions are limited to designated roles and are auditable.
Data is hosted on managed cloud infrastructure with encryption in transit (TLS 1.2+) and at rest (AES-256). Uploaded media is stored in private buckets and served only to authorized users. Regular backups are maintained for operational continuity.
All data access is enforced by server-side policies. Inputs are validated, authentication tokens are short-lived, and session handling follows industry best practices. Dependencies and configurations are reviewed regularly for known vulnerabilities.
We maintain procedures to detect, investigate, and respond to security incidents. If a breach affecting your data is confirmed, affected customers will be notified without undue delay and in line with applicable data protection laws.
We welcome security reports from researchers. Please report vulnerabilities to security@eventops.cloud and see /.well-known/security.txt for our disclosure policy. Do not access or modify data belonging to other users, do not degrade service availability, and give us reasonable time to remediate before public disclosure. We commit to acknowledging reports within 72 hours.