الأمان

• In transit: every connection to einvitation uses TLS (HTTPS), and we send HSTS headers so browsers never fall back to plain HTTP.
• At rest: guest emails, phone numbers and other personal fields are encrypted in the database with AES-256-GCM. Lookups use keyed hashes, so the plain values are never searched.
• Keys are kept outside the database and can be rotated without downtime.
• Passwords are never stored, only strong one-way hashes.

• Two-factor authentication with an authenticator app, plus single-use backup codes.
• Email verification codes at signup and for password resets.
• Rate limits and a captcha on sign-in to stop password guessing.
• A list of your active sessions, with the option to sign out any device or all of them at once.
• Optional sign-in with Google, Facebook or Apple.

• Team members get roles (such as admin, planner, assistant or day-of staff) that limit what they can see and change.
• Planner client portals are protected by a passcode, and door staff check-in links by a PIN. Repeated wrong guesses are locked out, and both can be changed or turned off at any time.
• Invitations can be public, password protected or open only through each guest's personal link.
• An activity log shows who changed what in shared accounts.
• Inside Noor Inc, production access is limited to the people who need it and is logged.

• Every page and API checks the signed-in user and their permissions on the server.
• Security headers such as a content security policy, frame protection and strict referrer rules.
• Uploads are checked for type and size, and images are processed before they are stored.
• Public endpoints are rate limited, and the public API returns only published, non-personal data.
• Dependencies are kept up to date and reviewed for known vulnerabilities.

einvitation runs with reputable cloud providers. The database is backed up regularly and backups are kept apart from the live servers. Server errors are monitored so we can respond quickly.

Card payments for einvitation are charged by Noor Inc, 95-390 Kuahelani Ave, Mililani, Hawaii, United States, and handled by Stripe, a PCI DSS Level 1 certified provider. Card numbers go straight to Stripe and never touch our servers.

We collect only what the product needs, never sell data, and never use guest data for our own marketing. Invitation view counts use an anonymous cookie that doesn't identify guests. See our Privacy Policy and Data Processing Agreement for details.

If something goes wrong, we investigate straight away, contain it, and tell affected customers without undue delay, and within 48 hours for personal data breaches, with what happened and what we're doing about it.

If you think you've found a security issue, please email support@einvitation.app with the details and steps to reproduce it. We acknowledge reports within 3 working days and keep you updated.

• Give us reasonable time to fix the issue before sharing it publicly.
• Don't access, change or delete other people's data; use your own test accounts.
• Don't run denial of service tests, spam or social engineering.

We won't take legal action against research done in good faith under these rules, and we're happy to credit you.