Security
How UKEDL (sole proprietorship; entity formation pending) operates UKEDL for organizers who need trustworthy uptime and honest capability claims.
Architecture summary
- Managed infrastructure. Web on Netlify, API on Render, PostgreSQL on Neon — listed as subprocessors in our Privacy Policy.
- Transport security. TLS for all public HTTPS endpoints.
- Encryption at rest. Provided by our managed database and host providers (Neon / Render / Netlify class controls).
- Authentication. Session cookies (HttpOnly, Secure in production, SameSite) with CSRF protection on cookie-authenticated writes. Passwords are hashed; secrets are not logged.
- Tenancy. Event and organization data access is scoped server-side; new endpoints ship with authorization tests.
- Backups and restore drills. Database backups are retained via the managed Postgres provider. We schedule restore drills as part of solo-ops hardening (documented in RUNBOOK when Phase S2 lands). Continuity goal: recover agenda-critical reads if writes are impaired.
Status
Public status page: https://status.ukedl.com (placeholder until the S2 provider is wired). Support hours: Weekdays 9:00–17:00 US Pacific. Event-day coverage is best-effort.
Downloads
- HECVAT Lite (PDF) — higher-ed vendor questionnaire lite pack (placeholder draft).
- Data Processing Agreement (PDF) — DPA for organizers (placeholder draft).
Data export and continuity
Signed-in users can export their own account data as JSON from Account (profile, memberships, attendance, and message metadata). We do not hold attendee data hostage: organizers can export event tables from the product, and account deletion cascade rules will be published once approved. During incidents we aim for read-only degradation so schedules remain available.
Product principles (anti-goals)
- No ads
- No attendee-data monetization
- No engagement bait
Report a vulnerability
Email support@ukedl.com. See also /.well-known/security.txt.