TiketCaribbean Security

TiketCaribbean is built and run by a small team. This page lists the security measures that are actually in place, in enough detail to be checked, and the ones we have not done yet. We would rather be plain about gaps than claim a certification we do not hold.

We hold no security certification (no ISO 27001, no SOC 2) and have not commissioned an external penetration test. We do not process card numbers ourselves; when you buy a paid ticket, the payment page is provided by Stripe, which is PCI DSS Level 1 certified.

Our domain is rated independently by SecurityScorecard. The live badge is third-party content, so it loads only if you have accepted analytics cookies; otherwise you see a link.

Knowing the stack lets you judge the rest of this page. The API is C# on .NET 8, running in Docker on Render, against PostgreSQL managed by Supabase; the website is React and TypeScript built with Vite and served by Netlify; Cloudflare provides Turnstile bot protection on our forms; Snyk scans our dependencies and code for known vulnerabilities.

• .NET 8
• C#
• React
• TypeScript
• PostgreSQL
• Supabase
• Docker
• Cloudflare
• Snyk

Transport and hosting

• All traffic to the website, the API and the app uses HTTPS (TLS 1.2 or 1.3). The website and API send HTTP Strict Transport Security headers with preload; the app refuses non-HTTPS connections.
• The website is hosted on Netlify with X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy and a Permissions-Policy that limits camera, location and microphone access to our own pages (the microphone is only used for voice dictation, and only after you allow it). A Content Security Policy is deployed in report-only mode while we validate it.
• The API runs on Render in a container; the database, sign-in service and file storage are provided by Supabase, which encrypts stored data at rest and in transit. Our cache runs on Upstash Redis over TLS.

Accounts and authentication

• Passwords are hashed with bcrypt and are never stored or logged in clear.
• Sign in with Google and Apple is available. On the app, Face ID, Touch ID or fingerprint can unlock the app locally; biometrics never leave the device.
• Session tokens are short-lived JSON Web Tokens signed with RSA-SHA256 (15 minutes), renewed by a refresh token that is stored hashed on our side and expires after 1 day, or 30 days if you choose Keep me signed in. Signing out or deleting your account revokes all sessions.
• One-time codes for email verification, password reset, account deletion and data export are hashed at rest and expire quickly.
• Repeated failed logins lock the account temporarily, and every endpoint is rate-limited.
• Cloudflare Turnstile protects sign-up and other public forms against bots.

Application

• Role-based access control separates members, organisers, scan-team members and staff; organiser data is scoped to the owning business.
• Anti-forgery tokens protect state-changing requests from the website; uploads are checked by file signature, size and type, and images are re-encoded (which also strips embedded metadata) and screened by Google Cloud Vision.
• User-supplied HTML in articles is sanitised on the server. Text sent to the organiser AI assistant is filtered on the way in and out.
• Secrets live in environment variables and hosting-provider secret stores, not in source control. Google Cloud Vision, Anthropic and payment keys are server-side only.
• Snyk scans our dependencies and code for known vulnerabilities, and we update affected packages as part of normal development.
• Sensitive audit and export metadata is encrypted in the database with AES-GCM.

Monitoring and response

• The mobile app reports crashes to Sentry without personal data. The API keeps structured logs and an audit log of sensitive actions with IP address and user agent.
• Background jobs reconcile payments, clean up expired tokens and exports, and remove unverified accounts after 7 days.
• Personal data breaches are handled as described in the Privacy Policy, including notifying the ICO within 72 hours where required.

For paid tickets and payouts we use these measures against fraud:

• The website checkout runs a Cloudflare Turnstile bot check, ticket reservations and purchases are rate-limited per account and per IP address, each account can hold only a limited number of tickets per event, and unpaid holds are released after a short time.
• Card details are entered on Stripe's pages, and Stripe screens payments with its own fraud tools (Stripe Radar).
• Ticket QR codes are signed, scans are recorded so a used ticket can be refused, and tickets on an order under a chargeback are flagged.
• Every new organiser business is reviewed by our team before its events go live, paid ticketing is approved business by business, Stripe verifies the identity, business and bank account of each organiser it pays out to, and the first payout to each business is reviewed by hand.
• We can hold payouts during chargebacks or a fraud review, cancel and refund orders, and recover refunds and chargebacks that happen after an organiser has been paid out from that organiser's later payouts.

The full terms, including what we may do when we suspect fraud, are in the Merchant Agreement under "Verification of Organisers and Businesses" and "Fraud Prevention and Payment Risk".

We list these so you can make your own judgement. There is no date attached to any of them; we will update this page when each one ships.

• Two-factor authentication. The setting appears in the app as "coming soon". It is not available.
• HttpOnly session cookies on the website. The website keeps its session tokens in cookies that JavaScript can read. They are marked Secure and SameSite, and tokens are short-lived, but a successful cross-site scripting attack could read them. We plan to move to HttpOnly cookies.
• Enforced Content Security Policy. Currently report-only.
• External penetration test and security certifications. None yet.
• Bug bounty. We accept reports (below) but do not pay rewards.

• Use a long, unique password. The sign-up form checks length and mix of characters.
• Do not share your account, your pass QR codes or ticket links; a copied code can be refused at the door.
• Sign out on shared devices, and use the app's biometric lock on your phone.
• We will never ask for your password by email or message. If you receive a suspicious message claiming to be from us, forward it to security@tiketcaribbean.com.

If you find a security problem, email security@tiketcaribbean.com with steps to reproduce it, the affected URL or screen, and any screenshots. Please do not access other people's data, run denial-of-service tests, or publish the issue before we have had a reasonable chance to fix it. We will acknowledge your report, keep you informed, and credit you if you wish. We do not pay bounties at present.