PheedLoop Trust Center

Event organizers trust PheedLoop with their attendees' information. Here's how we protect it, where it's stored, and how to get the documentation your team needs.

Request our security package
+
Hand holding a PheedLoop Customer Case Studies booklet with an illustration of two people shaking hands and a dog in front of circular icons representing virtual event concepts.
See How Planners Succeed with PheedLoop

Enter your email to see how 15 event pros used PheedLoop to run successful events, with strategies and results you can apply.

Check your email for the booket!
Oops! Something went wrong while submitting the form.

At a glance

Stored in Canada

Client data is stored on Amazon Web Services in Canada (Central), across two availability zones.

Encrypted

All traffic is encrypted in transit, and databases, files and backups are encrypted at rest.

Locked-down access

Multi-factor authentication is enforced on all staff access, and access to client data is limited and logged.

72-hour notification

If an incident ever affects your data, we notify you within 72 hours of confirming it.

Transparent sub-processors

Our sub-processors are published, with 30 days' notice before any change.

Built on AWS

Our infrastructure runs on AWS services covered by AWS's ISO 27001, SOC 2 and other independent audits.

Security

Our security program is defined in a set of 20 security and privacy policies, approved by our CEO and reviewed every year. It covers access control, encryption, secure development, vulnerability management, incident response, business continuity and disaster recovery.

Every code change is peer reviewed and automatically tested, including tests that confirm one client can't access another client's data. Vulnerabilities are fixed within set timeframes based on severity, and our first independent penetration test is planned for 2027.

Documentation

A summary of our security program, controls and infrastructure.

Read our Security Overview →

Privacy and GDPR

When you run an event on PheedLoop, you decide what attendee information is collected and how it's used. You're the controller of that data, and PheedLoop processes it on your behalf as your processor.

We help you meet your obligations under the EU and UK GDPR, Canada's PIPEDA, Québec's Law 25 and US state privacy laws:

A Data Processing Addendum that sets out our commitments as your processor

A published sub-processor list, with 30 days' notice and the right to object before we add or change one

Legal safeguards for international transfers, including the EU adequacy decision for Canada and contractual protections with US sub-processors

Tools and support to respond to attendee requests to access, correct or delete their information

As controller, you remain responsible for your lawful basis for collecting attendee data and for any consent your event requires.

Related
Privacy Policy →Sub-processors →

Request our DPA at privacy@pheedloop.com

Where your data lives

PheedLoop is a Canadian company, and our entire team is based in Canada. Client data is stored on AWS in the Canada (Central) region, with backups kept in the same region.

A small number of sub-processors, mainly for analytics, support, error monitoring and real-time messaging, process limited data in the United States. Each one is listed on our sub-processor page, along with the data it handles and where.

Payment security

PheedLoop never stores, processes or transmits card numbers. When an attendee pays, their card details are entered into fields provided by the event organizer's payment processor and go directly from their browser to that processor. PheedLoop receives only a transaction reference.

Organizers connect their own accounts with supported processors, including Stripe, PayPal, Moneris, Bambora and Authorize.Net, each of which maintains its own PCI DSS compliance.

Reporting a vulnerability

We welcome reports from security researchers. Email security@pheedloop.com and we'll acknowledge your report within 3 business days. Good-faith research under our policy is covered by safe harbour.

Read our Vulnerability Disclosure Policy →

System status

Check live platform status and incident history at status.pheedloop.com.

Documents

Document
Access
Security Overview
Access
Privacy Policy
Access
Sub-processor list
Access
Vulnerability Disclosure Policy
Access
AWS compliance programs (ISO 27001, SOC 2 and more)
Access
Full security and privacy policy set
Access
Completed SIG Lite questionnaire
Access
Architecture and data flow documentation
Access
Data Processing Addendum
Access

Request our security package

Reviewing PheedLoop for your organization? We'll send our full policy set, completed SIG Lite questionnaire and supporting documentation once a mutual NDA is in place.

Thanks for submitting your security inquiry to PheedLoop! A member of our team will review your request and be in touch shortly. Have a wonderful day.
Oops! Something went wrong while submitting the form.

Questions?

Security questions

security@pheedloop.com

Privacy questions and data requests

privacy@pheedloop.com