Security
How UKEDL (sole proprietorship; entity formation pending) operates Readyhall for organizers who need trustworthy uptime and honest capability claims.
Architecture summary
- Managed infrastructure. Web on Netlify, API on Render, PostgreSQL on Neon — listed as subprocessors in our Privacy Policy.
- Transport security. TLS for all public HTTPS endpoints.
- Encryption at rest. Provided by our managed database and host providers (Neon / Render / Netlify class controls).
- Authentication. Session cookies (HttpOnly, Secure in production, SameSite) with CSRF protection on cookie-authenticated writes. Passwords are hashed; secrets are not logged.
- Tenancy. Event and organization data access is scoped server-side; new endpoints ship with authorization tests.
- Backups and restore drills. Database backups are retained via the managed Postgres provider. We schedule restore drills as part of solo-ops hardening (documented in RUNBOOK when Phase S2 lands). Continuity goal: recover agenda-critical reads if writes are impaired.
Status
Live service status is published at https://ukedl.betteruptime.com. During an incident, check the status page first, then email support@readyhall.com for updates. Support hours: Weekdays 9:00–17:00 US Pacific. Event-day coverage is best-effort.
Downloads
HECVAT Lite and our Data Processing Agreement are available on request — email support@readyhall.com.
Data export and continuity
Signed-in users can export their own account data as JSON from Account (profile, memberships, attendance, and message metadata). Account deletion is live: email and password re-authentication, immediate deactivation, a 7-day grace period during which signing in or cancelling restores the account, then permanent deletion with an audit trail. We do not hold attendee data hostage — organizers can export event tables from the product. During incidents we aim for read-only degradation so schedules remain available.
Payments are processed by Stripe as merchant of record; card data never touches Readyhall servers.
What we can verify in this product today: essential cookies only (no analytics or advertising cookies); encryption in transit (TLS) and at rest (provider-managed); tenant isolation covered by automated tests; audit logging of sensitive actions; private files are served through the API after an authorization check; live status at https://ukedl.betteruptime.com; vulnerability contact via /.well-known/security.txt. Every AI feature can be switched off per event by the organizer, and the attendee Event assistant answers only from the published content of that event.
Product principles (anti-goals)
- No ads
- No attendee-data monetization
- No engagement bait
Report a vulnerability
Email support@readyhall.com. See also /.well-known/security.txt.