Security and Data Handling

Where it runs

The website and app run on Vercel, and the database is Neon Postgres. Email goes out through Resend, and payments go through Stripe, Square or PayPal. Every company that handles personal information for us is listed, with what it receives, in the privacy policy.

All traffic to myvenuehq.com and app.myvenuehq.com uses HTTPS. Our two main providers publish how they protect data: Vercel states that it encrypts data at rest with AES-256 and in transit with HTTPS/TLS, and Neon states that it encrypts customer data at rest with AES-256 and requires TLS for connections.

Accounts and sign-in

New accounts need a password of at least 10 characters. Passwords are stored only as argon2 hashes, so we can’t read one or send it to you.
Sign-in, sign-up, password reset and other sensitive requests are rate limited to slow guessing.
You stay signed in with a signed cookie that scripts on the page can’t read. It lasts up to 30 days, or until you sign out.

Who can see what

Each person on a venue’s team has a role: owner, manager, event coordinator, staff or client. The role decides what they can open and change. Every request for a venue’s records is limited to that venue, and automated tests check that one venue can’t read another’s records through our routes.

Payments

Card numbers never reach our servers. Subscriptions, invoices, deposits and tickets are paid on pages hosted by Stripe, Square or PayPal, and we keep only the payment’s reference, amount and status. We check the signature on every payment notification those processors send us before we act on it.

Files, links and signatures

Files uploaded to the app are stored at long, unguessable web addresses. Anyone who has a file’s address can open it, so share addresses only with people who should see the file.
Proposals, contracts to sign, shared floor plans and event pages open by link without an account. Each link carries a long random token.
When someone signs a contract we store the signature, the time and the signer’s IP address as the record of signing.
Insurance certificates that a venue or its vendors upload are private. Only the venue’s own team can open them, and the link we email a vendor can upload a certificate for that one vendor and nothing else. It stops working after 30 days.

Export, deletion and backups

Owners and managers can download all of a venue’s data from Settings, under Export your data. It arrives as spreadsheet files in one zip.
You can delete your account and its data yourself in Settings, under Your account. If you own a venue other people work in, we ask you to hand it over first, so nobody loses their workplace. You can also ask us by email.
Our database provider keeps a rolling history of recent database changes for a limited time, so we can restore the database to an earlier moment after a mistake. A deleted account leaves that history when its window ends.

The privacy policy has the full retention table and your rights.

How we build it

Before a change ships, an automated check scans our code for insecure patterns and for committed secrets, and our dependencies are checked against known security advisories. Changes that touch payments, sign-in, permissions or email sending need automated tests before they ship.

What we don’t have

MyVenueHQ holds no third-party security certification, such as SOC 2 or ISO 27001, today. The companies that host our data publish their own security and compliance documentation, linked above. We don’t claim our software can’t be breached, and no service can. If a breach affects your information, we will tell you and the authorities as the law requires.

Report a problem

Email hello@myvenuehq.com with what you found, where, and how to reproduce it. Please don’t open other customers’ data or disrupt the service while testing. We reply within three business days. The same details are in our security.txt file.

Colorado Web Forge LLC operates MyVenueHQ. See also the privacy policy, terms of service and cookie policy, or read about MyVenueHQ.