Your account, your tickets and your data belong to you. This is what we do to keep it that way, why, and what we do not have yet. No big words: only what really works like this.
Checked on the suppliers' own pages on 18 October 2026. Which service each certification covers exactly is under Privacy.
How fast we respond
1 to 2 hoursIncident or risky reportA person responds within 1 to 2 hours. Always, weekends included.
1 to 2 working daysGeneral security questionA question about how we secure something, or a report without a direct risk.
Risky is anything that could put other people's data, logging in, payments or tickets at risk. In doubt, report it as risky.
We never ask for your code
Not by mail, phone, chat, Discord or DM. Your login code, your passkey and the code of your authenticator app are for you to use yourself, on partyppl.nl or in our app. If someone asks for one, it is a scam.
Every time you open a page or buy a ticket, your request passes five layers. Each layer has its own protection.
1Your browser or appWith you
HTTPS only, subdomains included (HSTS)
A session cookie scripts cannot read
2CloudflareNetwork
Encrypted connection to your browser
DNS, proxy and CDN for every host
Keeps scrapers out
3Our web serverGermany
Takes web traffic from Cloudflare only
Encrypted between Cloudflare and us too
4The appGermany
Strict Content Security Policy
Origin checks and limits
Permissions checked on every request
5The databaseGermany
Sessions and tokens as hashes only
Two-factor secrets encrypted
A backup every 6 hours
What it runs on
Our own servers at OVHcloud, with Cloudflare in front. Three things you normally do not see:
Busy
Normally the main server does everything. When it gets busy, we wake a third server by itself that shows public pages from a copy that only reads. Your account, your tickets and payments stay on the main server.
Bots
If you are not logged in and open an event page, Cloudflare first runs a short check. That keeps out scrapers that could take the site down. Our app and verified search engines pass straight through.
Outage
Server 2 keeps a continuous copy of the database. If the main server fails, server 2 takes over the site by itself in a mode that only reads: browsing works, buying and chat wait.
The main server and server 3 are at OVHcloud in Germany, server 2 at OVHcloud in Canada, a country covered by an adequacy decision of the European Commission. gaming.partyppl.nl runs on the same servers, with the same measures.
Whether everything works right now is on the status page. On top of that we are building our own security monitoring, which reads the logs of our servers together.
What we do
The measures follow the NCSC guidelines for web application security (the Dutch National Cyber Security Centre). Per topic: what actually runs.
Login without a password
There is no password that can leak or that you also use somewhere else.
You log in with a 6-digit code we mail you. It works for 10 minutes, once, and stops working after a few wrong tries.
Faster and stronger: a passkey (Face ID, Touch ID or your password manager). It only works on partyppl.nl, which makes it impossible to phish.
You can add two-factor authentication with an authenticator app, with recovery codes you can use once. Turning it off needs a current code.
Our own team has to use a second factor. For sensitive actions, such as granting roles, suspending accounts, paying out money or creating keys with admin rights, we ask for that factor again when the last time was too long ago.
Sessions and cookies
Staying logged in without anyone else being able to take over your session.
Your session is a random 256-bit key in a cookie with the __Host- prefix: HTTPS only, unreadable for scripts (HttpOnly), with SameSite, and bound to the one address that set it.
We only store a hash of that key. Someone reading the database could not log in with it.
A session ends after 30 days, or after 14 days of doing nothing. Your settings show which devices you are logged in on, and you log them out one by one or all at once.
The admin and the books run on subdomains of their own with a session of their own that lives shorter. A cookie of the site never gets there.
Encrypted in transit
Everything between you and us is encrypted, the part you do not see included.
HTTPS only. With HSTS your browser remembers for a year that partyppl.nl and its subdomains may never be loaded unencrypted.
Cloudflare sets up the encrypted connection with your browser. From Cloudflare to our server the connection is encrypted again, with a certificate Cloudflare checks.
Our server takes web traffic only from Cloudflare, and Cloudflare shows a certificate of its own on every request.
A strict browser policy
The page itself tells your browser what is and is not allowed.
A Content Security Policy with a nonce per request: only scripts we sent along for that one page run. No unsafe-inline and no unsafe-eval for scripts.
Our pages may not be framed by another site (against clickjacking), browsers do not guess file types, the microphone stays closed, and only our own site may ask for the camera or your location.
Uploaded files are served in a sandbox, so a file can never run as code on our site.
Origin checks and limits
Another site cannot act on your behalf, and guessing does not pay.
Every change has to come from our own page. That is on by default for every route, also for one added tomorrow.
Logging in, checking codes, passkeys, two-factor authentication, uploads and messages each have their own limit per address and per connection.
If you are not logged in and open an event page, Cloudflare first runs a short check, usually without you noticing. That keeps scrapers out. Our app and verified search engines pass straight through.
We check everything that comes in on the server: type, length and shape. An upload is recognised by its bytes, not by what the browser says, and we strip the metadata from photos.
Permissions per role
Everyone sees and does only what belongs to their role.
Organisations have five roles: Owner, Admin, Marketing, Door and Finance. Whoever scans at the door does not reach the finances; whoever does the marketing does not reach the team.
On the server we check on every request who you are and what you may do. Ownership is part of the database query itself: you cannot read someone else's data by changing a number in an address.
Buying, chatting and other social features first need the 18+ step.
Logs and retention
We can find out what happened, without keeping more than needed.
Logins, failed attempts, passkeys, two-factor authentication and logouts go into a security log. Never your login code, and never your e-mail address in a log line.
Every action of our team goes into an audit log, also what a connected tool does on our behalf.
Every night a copy of both logs goes to our second server, in a chain of hashes. Whoever took over the main server could no longer change that history there.
The security log goes after 12 months, the audit log after 24 months, the web server's access logs after 7 days.
We are building our own security monitoring, which reads the logs of our servers together and warns us.
Payments
Your card details never reach us.
Payments go through Stripe. You enter your card or bank details at Stripe itself; we only hear that it was paid, and how much.
Resale works through PartyPPL itself, at the original price.
We check Stripe's messages about payments by their signature, and handle each message once.
Backups
If something goes wrong we can go back, and those copies are protected themselves.
A backup of the database and the mail every 6 hours, and of the files and the server settings every day. Each backup is checked for errors before it is stored.
A copy leaves the server, to our second server, encrypted. The key that opens that copy is on no server at all.
From here that copy can only be added to, not erased or overwritten.
Restoring has been practised: on 2 October 2026 we restored the database, the mail, the files and the settings from a backup and checked them.
Standby and monitoring
If our main server fails, the site can still be read.
A second server keeps a continuous copy of the database, over an encrypted connection of its own.
If the main server is gone, that second server takes over the site by itself in a read-only mode: browsing works, buying and chat wait. That way two databases never drift apart.
That second server checks from outside every minute whether partyppl.nl answers. On top of that the status page checks every part every five minutes.
When it gets very busy a third server is woken to help show public pages, from a copy that only reads. Everything about your account, your tickets and payments stays on the main server.
Little data, no trackers
What we do not have cannot leak.
No ads, no third-party trackers and no selling of data. Our own statistics work without a cookie.
Fonts come from our own server, so no font service sees which page you read.
To be fair: the map loads tiles from OpenFreeMap, which sees your IP address while doing so, and a video from YouTube, SoundCloud or Mixcloud only loads when you tap play yourself.
Reviewed regularly
Security is not a checkbox but maintenance.
On 15 September 2026 we went through the whole platform against the NCSC guidelines and fixed the findings.
On 18 October 2026 we reviewed everything added in the days before. That gave eight findings, two of them high. For all eight the fix is in the code.
On every change automated tests run, against the security rules, the headers and the permissions too. At every review we check the packages we use for known vulnerabilities.
These are our own reviews, not an audit by an outside party.
What we meet ourselves
Standards and rules we apply ourselves and check ourselves.
PCI DSS, through SAQ A
You enter your card details at Stripe only: on Stripe's payment page, or in the Apple Pay and Google Pay buttons Stripe itself draws on our page. They never reach our servers. That puts PartyPPL under SAQ A, the lightest self-assessment of PCI DSS. A self-assessment, not a certificate.
GDPR
A record of processing activities (article 30), a DPIA screening (article 35) with a DPIA of its own for new processing with more risk, data processing agreements with the suppliers that process data for us, and our own data processing agreement for organisers. We report a data breach to the Dutch regulator within 72 hours.
NCSC guidelines
The NCSC guidelines for web application security are our baseline. On 15 September 2026 we went through the whole platform against them, on 18 October 2026 through everything added since.
security.txt (RFC 9116)
Each of our addresses has a valid security.txt, with our report address, our key and this policy.
DSA: notice and action
You report illegal content to us under the Digital Services Act (article 16), and you get our decision back with the reason. See the DSA page.
PartyPPL itself holds no ISO or SOC certificate, and there has been no audit by an outside party yet. What is above, we check ourselves.
What we do not have yet
No certification of PartyPPL itself, such as ISO 27001 or SOC 2. Our suppliers do have them; which ones is under Privacy.
No penetration test or audit by an outside party. It is on our list.
No data protection officer.
No security team watching day and night. What we do have: monitoring that warns us, and reports that reach a person straight away.
Why we leave out details
We say what we do, not exactly how to get around it. Exact limits, versions and addresses of internal systems are therefore not here. If you want to dig deeper, do so under the ground rules on Report a vulnerability.