Security
at every layer.

All data flowing in and out of the Vowly Event platform is encrypted using industry-standard algorithms: modern TLS for data in transit, and AES-256 at rest for our database and file storage, managed by Google Cloud.

• HTTPS/TLS enforced for all client–server connections
• AES-256 encryption at rest for Cloud Firestore and Cloud Storage (Google-managed keys)
• Passwords are handled entirely by Firebase Authentication using Google's hardened, salted hashing — we never see or store your password
• API keys and integration secrets live in Google Cloud Secret Manager, never in code

Vowly Event is built and operated by a deliberately small team, which keeps the number of people who could ever touch production data at an absolute minimum. All customer data access flows through server-side security rules — there is no broad internal access layer.

• Server-side security rules on every database and storage read/write — only you, and teammates you explicitly invite, can access your events
• Production access restricted to named accounts via Google Cloud IAM
• A single hardened admin panel with its own sign-in verification and request attestation (App Check)
• Administrative and moderation actions recorded in an audit log

Vowly Event runs on Google Cloud / Firebase. Your event data is stored in the EU: the database is replicated across two EU regions (Belgium and the Netherlands), file storage uses the EU multi-region, and our serverless backend runs in Frankfurt. Only sign-in (Firebase Authentication) is operated by Google from US data centres, under EU-approved transfer safeguards.

• Cloud provider: Google Cloud / Firebase — ISO 27001 and SOC 1/2/3 certified infrastructure; ISO 27017/27018 additionally for Firestore, Cloud Functions, Cloud Storage and Authentication
• Database: Cloud Firestore, EU multi-region (eur3: Belgium & the Netherlands)
• File storage: Cloud Storage, EU multi-region
• Serverless backend: Cloud Functions in europe-west3 (Frankfurt)
• Content delivery and DDoS protection by Google's global edge network; DNS by Cloudflare
• Daily encrypted database backups with 35-day retention, 7-day point-in-time recovery, and 30-day recovery for deleted files

Every guest-facing and sensitive endpoint is defended server-side: requests are rate-limited, attested, validated and logged. Security-relevant events are kept for 90 days and reviewed when anything looks unusual.

• Server-side rate limiting on all guest-facing and sensitive endpoints
• Request attestation with Firebase App Check (reCAPTCHA v3) on web surfaces
• Server-side input validation with length caps and spam honeypots on every guest write path
• Security events (failed attempts, abuse signals) logged and retained for 90 days
• Error monitoring with personal-data collection switched off

Every change to the platform goes through version control and automated quality gates before it can reach production. Guest-facing write paths are treated as hostile by default and validated on the server, never in the browser alone.

• Typed code with automated lint and type-check gates on every deployment
• Security headers (Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy) on our web surfaces
• All secrets kept in Google Cloud Secret Manager — never committed to the repository
• Server-side enforcement: security rules and callable functions validate every write, so bypassing the UI gains nothing
• Regular dependency updates and security reviews of high-risk paths

Despite our best efforts, no platform is immune to security incidents. If we detect a personal data breach, we follow a documented incident response plan and will notify affected users and the UK ICO within 72 hours, in accordance with UK GDPR Article 33.

• Documented incident response plan with defined severity levels
• Automatic owner-level alerts for critical account, billing and deletion events
• Post-incident review and remediation for every significant incident
• 72-hour breach notification commitment to supervisory authorities and affected users

Vowly Event is built on Google Cloud infrastructure that holds the industry's leading security certifications, and the platform itself is engineered privacy-first: consent-gated analytics, EU data residency for your event data, and documented records of processing. Google's certifications apply to the underlying cloud infrastructure; they are not an independent certification of Vowly Event or CKR Technology Group Ltd.

• UK GDPR & EU GDPR — privacy by default, consent-first analytics, documented records of processing
• UK Data Protection Act 2018
• PCI DSS — Stripe processes all payment data; full card numbers never touch our servers
• Google Cloud infrastructure certifications: ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3
• EU data residency: database and file storage in Google Cloud's EU multi-regions

We appreciate the security community's help in keeping our platform safe. If you discover a vulnerability, please report it to security@vowly.co with a clear description, reproduction steps, and your contact information. We commit to acknowledge reports within two business days and to work with you on responsible disclosure timelines.