Security and trust

This page is for anyone deciding whether to trust this platform with an event: what protects the data, who is behind that work, and where the details are published.

Who handles security and privacy

Information security and privacy are handled by the operator personally. The operator has completed the Data Protection Officer (60 h) and Chief Information Security Officer (210 h) certificate programmes at Bar-Ilan University and the INCD (Israel National Cyber Directorate) Cyber Defense Doctrine 2.0 programme, and maintains the platform's internal security procedure, risk assessments and incident-response plan on that basis. No statutory Data Protection Officer is appointed, and none is required for processing of this kind and scale.

Standing measures, in brief

• Access is segregated per event: organisers reach only their own event, guests only their own gallery, and gallery media is served through short-lived signed links.
• Access codes and one-time codes are stored only as salted hashes; sign-ins and failed attempts are logged so unfamiliar activity stands out.
• Uploads pass automated screening with human review; location and camera metadata is stripped from photos server-side.
• Retention runs on a schedule, not on somebody remembering: a daily automated job closes the gallery on the day the guests were told, anonymises guest data within six months of the event and deletes it at 24 months, warning organisers 30 days and 3 days ahead.
• A written incident-response plan with jurisdiction-by-jurisdiction notification duties stands ready; consent and acceptance records are kept as tamper-proof, server-only evidence.

The detail lives on the published pages: the Privacy Policy ("Who is responsible for what", security and retention), the Data Processing Addendum (/legal/dpa) and the subprocessor list (/legal/subprocessors). Vendor due-diligence questions: [email protected]