Hosting and data residency
Hosted in the EU by default, with a US region available. Data residency is fixed per event organization at setup and does not move without a written request. Named region and provider are given in the DPA.
Security
For the person reviewing us, not the person buying us
This page exists to answer a security questionnaire. It is linked from the footer and nowhere else, and there is no call to action on it.
Access control
Roles are per event organization. Every action is checked against a named policy, and no data crosses between organizations under any circumstances. Staff access is limited, logged, and granted only for a support request you have raised.
Backups and retention
Continuous backup with point-in-time recovery for 35 days. Retention after an event closes is set by you, with a documented default. Deletion on request within 30 days, confirmed in writing.
Incident response
Named responder, defined severity levels, and notification to affected customers within 72 hours of confirmation, including what happened and what we did. Post-incident write-up shared, not summarised.
Subprocessors
A current list is maintained and published, with notice before any addition. Cloud hosting, transactional email, error monitoring, and mapping. No advertising or analytics vendors receive customer data.
SOC 2
Not certified today. Controls are being documented against SOC 2 Type I with an audit targeted for 2027. We would rather tell you that than imply otherwise, and we will answer your own questionnaire in the meantime.
Continuity
The real objection is not privacy, it is irreversibility. The event happens once, and there is no next quarter in which to fix it. So it is worth saying plainly what happens if we fail you.
Full export, any time
Every item, request, approval and receipt in an open format, on demand, without asking us. Not a support ticket, a button.
A documented fallback
A written procedure for running the rest of your event on exports if you have to, tested and given to you at kickoff — not written after something goes wrong.
Source escrow
Available on request for founding customers, released on defined triggers. If we are not here in eighteen months, your event still is.
DPA available on request, before any commercial conversation. hello@roadmap.events