Trust & security

It is a fair question to ask of any independent software company, and the honest answer is that you are never locked in. CompleteEvent is built so that the things that matter most — your attendee records and your money — never depend on us continuing to exist.

• Your money is already yours. Ticket revenue is paid directly into your own Stripe account at the moment of sale. CompleteEvent never holds your funds. If you stopped using us tomorrow, your Stripe balance and payout schedule are unaffected.
• Your data is exportable at any time. Every event exports a full attendee and registration record to CSV, plus a GDPR data export — on demand, on every plan, without a support ticket.
• Your attendees reach you, not us. Enterprise events run on your own custom domain, so your public presence is not tied to our brand.

You own your data. We store what you and your attendees enter so the platform can run your event — we do not sell it, and we do not use it to advertise to your attendees.

Export options: full CSV export of registrations, sessions, and revenue from the dashboard; a per-person GDPR export for data-subject requests; and CSV exports for seating and sponsor leads. Data is encrypted in transit (TLS) and at rest.

CompleteEvent runs on Vercel (application hosting) and Supabase (managed PostgreSQL database and authentication). Both are established, SOC 2–audited infrastructure providers. We do not run our own physical servers.

All traffic is served over HTTPS. The platform is designed to stay available during your highest-traffic moments — registration launches and event-day check-in — and check-in works offline on the mobile app, syncing when the connection returns, so a venue with weak Wi-Fi does not stop your door.

Your database is backed up automatically on a daily schedule through our managed database provider. Backups are used to restore service in the event of data loss. Because your revenue lives in your own Stripe account and your records are exportable at any time, you also always hold an independent copy of your most critical data.

All card payments are processed by Stripe, which is certified to PCI DSS Level 1 — the highest level. Card numbers are entered directly into Stripe's hosted fields and never touch or get stored on CompleteEvent's servers. We see the outcome of a charge, not the card.

You connect your own Stripe account, so payouts, refunds, and dispute handling all happen through infrastructure you control.

• Row-level security is enforced at the database on every table, so one organization's data cannot be read by another.
• Two-factor authentication (TOTP) is available on every plan.
• SSO / SAML login is available on the Enterprise plan.
• An audit log records administrative actions so you can see who changed what.

We publish a Privacy Policy, Terms of Service, and a Digital Services Act statement. The platform supports GDPR data-subject requests through per-person data export.

Associations and universities that require a Data Processing Agreement (DPA) can request one — email security@completeevent.app.

Attendee-facing pages — registration, tickets, schedules, and the mobile guide — are built to target WCAG 2.1 AA: keyboard navigation, semantic markup, and sufficient color contrast. Schools and universities that need an accessibility conformance report (VPAT) for procurement can request the current version at security@completeevent.app.

Support is included on every plan by email at hello@completeevent.app. Enterprise plans include priority support. During the week of your event, reach us the same way and flag it as event-week — live events come first.