Trust & Security

Access & authentication

• Visitor guides at /e/<event> and display screens at /display/<event> are intentionally public — no sign-in is required to view published event content.
• The admin console under /admin requires email/password sign-in.
• Admin roles are stored in a dedicated database table and checked server-side on every write; the application never trusts client-supplied role data.
• Admin pages are marked noindex,nofollow so they don't appear in search results.

Data we collect & how it's stored

• Event content — schedules, vendors, sponsors, maps, hotspots, announcements, help items — is created by event admins and intended to be public to visitors.
• Admin accounts hold an email address and an authentication record managed by our hosting provider's auth service.
• We do not collect visitor accounts, payment information, or location data.

Database & storage controls

• Row-level security is enabled on every application table; public reads are limited to rows explicitly marked published.
• Writes to event content and to the image storage bucket require an authenticated admin role.
• Internal error messages are not surfaced to visitors — public routes show a generic message and detailed errors stay in server logs.

Hosting & subprocessors

The application is hosted on managed cloud infrastructure (Cloudflare for the web runtime and Supabase for the database, auth, and storage layers). These providers publish their own security and compliance information; please review their documentation directly for certification details. We update this page when our subprocessor list changes.

Contact & responsible disclosure

If you believe you have found a security issue, or you'd like to make a privacy request related to this site, please contact the event organizer listed on the relevant visitor guide. The Porter Property Concierge team will update this page with a dedicated security contact address as soon as one is published.