We hold attendance and contact data for real fans and patrons on behalf of artists and venues. That's a responsibility, not just a feature. This page explains, plainly, how we protect it — and links to independent scanners so you can verify it yourself right now, rather than take our word for it.
Verify it yourself
These are free, independent, third-party tools — not run or controlled by us. Click any of them and you'll see our live grade, checked against our production site at this moment.
How we protect data in transit and at rest
- All traffic is served over HTTPS/TLS, auto-renewed by our host, and forced there — HTTP requests are upgraded automatically, and a Strict-Transport-Security header tells browsers to never fall back.
- A Content-Security-Policy header restricts which sources of scripts, styles, images, and connections the site will ever load, to reduce the blast radius of any injected content.
- Passwords are hashed with bcrypt — we cannot see or recover your plaintext password, and neither could an attacker who obtained our database.
- Our database (Neon/PostgreSQL) is encrypted at rest and in transit and is not publicly reachable — only our application servers can connect to it.
- StageOwn never stores payment card numbers. Card payments are handled entirely by Stripe, a PCI-DSS Level 1 certified processor.
How we protect data by design
- Every account is scoped: an artist can only see their own fans, a venue can only see their own patrons. There is no shared pool.
- Admin-level access to cross-account data is restricted to a small internal team, gated behind authentication, and used only for support and platform operation — never for marketing to your list.
- We do not sell, rent, or share fan or patron data with third parties, and we do not use it for our own advertising.
- Your exported data belongs to you. Every list can be exported at any time — there is no lock-in.
If something goes wrong
No system is perfectly secure, and we won't pretend otherwise. If we discover a security incident affecting your data, we investigate and contain it immediately, and notify affected account holders without undue delay. The full commitment is in our Privacy Policy.
Found a vulnerability? We want to know before anyone else does. Email security@stageown.com and we'll respond promptly.