Tenant isolation
Application authorization is backed by forced PostgreSQL row-level security. Every tenant request establishes organization and actor context, and cross-organization access is covered by database integration tests.
Security foundation
A serious foundation for business records
Eventos is designed as a multi-tenant SaaS product for private customer, contract, employee, and financial records. Security is part of the data model and request path—not an add-on.
Identity and sessions
Sessions use secure server-managed cookies, CSRF protection, bounded idle and absolute lifetimes, rotation, rate limits, and expiring single-use account tokens.
Reliable evidence
Accepted commercial versions, signed document snapshots, payment events, and audit history are preserved. Corrections use explicit revisions or compensating records.
Constrained integrations
Postmark, object storage, Redis, and Stripe SaaS billing sit behind narrow provider boundaries. PostgreSQL remains the source of truth, and rental-client card processing is not part of the current product.
Responsible disclosure
Security reports can be sent to security@eventossoftware.com. Please avoid accessing another customer’s data, changing records, disrupting service, or publishing a report before Eventos has had a reasonable opportunity to investigate.
See the complete rental workflow.
Start with the private-beta trial or review the single Eventos subscription.