Security and Compliance

Security Overview

CompleteEvent is built on Supabase with row-level security (RLS) on all database tables. This means every database query is automatically scoped to the authenticated user's organization — no custom middleware required to prevent cross-organization data leaks. All data is encrypted at rest and in transit using industry-standard encryption.

Two-Factor Authentication (2FA)

We strongly recommend enabling two-factor authentication on your CompleteEvent account, especially if you manage events with payment data or sensitive attendee information.

Setting up 2FA

1. Open the account menu and choose My account. Find the Two-Factor Authentication section.
2. Click Enable 2FA.
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, or any TOTP-compatible app).
4. Enter the 6-digit code from your authenticator app and click Verify & Activate.

After 2FA is enabled, every login will require both your password and the current code from your authenticator app.

Disabling 2FA

To disable 2FA, go to My account → Two-Factor Authentication and click Disable 2FA, then confirm.

If You Lose Access to Your Authenticator

CompleteEvent does not issue backup codes. If you lose access to your authenticator app, contact us at support@completeevent.app for account recovery. Identity verification will be required.

SSO / SAML (Enterprise)

Enterprise customers can configure SAML-based SSO to allow team members to log in with their company identity provider (Okta, Azure AD, Google Workspace, etc.). When SSO is configured, team members can log in via their organization's identity provider without needing a separate CompleteEvent password.

To request SSO, go to Organization Settings → Security and save your SSO settings. Our team is notified and completes the identity provider setup on the backend. You can also email support@completeevent.app. You will need:

• Your identity provider's metadata XML or metadata URL.
• The email domain(s) that should be routed through SSO.
• A designated SSO administrator contact at your organization.

SSO is available on the Enterprise plan. We follow up within one business day to confirm SSO is live for your domain.

GDPR: Data Export

Under GDPR (and similar regulations), individuals have the right to request a copy of their personal data. Anyone with a CompleteEvent account can download their own data:

1. Open the account menu and choose My account.
2. Under Export Your Data, click Download JSON Export.

The attendee export includes profile, event registrations, session sign-ups, abstracts, and survey responses. Organizer accounts receive their full account data by email instead (allow up to 24 hours).

If an attendee asks you directly, export their registration records from your event's registration list (CSV) and send them within your jurisdiction's required timeframe (30 days under GDPR).

GDPR: Data Deletion Request

Individuals also have the right to request deletion of their personal data (the “right to be forgotten”). Anyone with a CompleteEvent account can submit a request from My account → Request Data Deletion. Our team processes it within 30 days. For an attendee without an account, contact support@completeevent.app.

Audit Log

The organization audit log records all significant actions performed by team members. Open it from Organization Settings → Team → View audit log. The log includes who performed each action, what resource was affected, and when.

From a security perspective, review the audit log if you:

• Suspect unauthorized changes to your events.
• Want to confirm when a team member was added or removed.
• Are responding to a security incident or compliance audit.

The audit log is available on all plans and is retained for 12 months.

Password Security

CompleteEvent uses Supabase Auth for password management. Passwords are never stored in plaintext — they are hashed using bcrypt. We recommend:

• Using a unique, strong password (12+ characters).
• Using a password manager to generate and store your password.
• Enabling 2FA as a second layer of protection.

If you suspect your account has been compromised, reset your password immediately with Forgot password? on the login page, then review the audit log for unexpected actions.

Reporting a Security Issue

If you discover a security vulnerability in CompleteEvent, please report it responsibly by emailing security@completeevent.app. Do not disclose vulnerabilities publicly until we have had a chance to investigate and address the issue.