EventScan Pro

Security & Data Protection

Last updated 22 October 2026 · for IT, procurement and data privacy teams

1. Where the data is

Google Cloud holds ISO/IEC 27001 certification and SOC 2 reports for the services we use. Strong Media Corp itself is a small company and does not hold its own certification; this page describes what we do instead.

2. Who can see what

• You, the organiser: sign in with your account's access code. The database's own access rules limit every account to its own events — this is enforced by Google's servers, not just hidden in the app.
• Door staff: get a scanner link with a key for that one event. It cannot open your other events, your account or your settings. You can replace the key at any time, and the old link stops working.
• Guests: see only their own pass.
• Strong Media Corp: only authorised staff, and only to run or support your event.
• Payment status, guest limits and branding can only be changed by our server — never from a browser.

3. Passes that cannot be faked

Every event has its own secret key. Each guest's QR code carries their guest number and a signature made with that key (HMAC-SHA256). The scanner checks the signature: a code someone typed up, copied from a different event, or edited is refused. A pass that has already been used shows Already checked in with the time and the door, so a screenshot passed back over the barrier is caught.

4. How it is protected

• All traffic — website, app, database — is encrypted in transit (HTTPS/TLS). Google encrypts stored data at rest.
• Server credentials are kept outside the public part of our web server.
• Sign-in attempts, sign-ups and outgoing mail are rate-limited to stop guessing and abuse.
• Web addresses you give us for sending check-ins to your own system are kept on the server only, never in a page a guest or door phone can read.

5. At the door, with no signal

So check-in keeps working when the venue's signal drops, a door phone keeps a copy of that event's guest list in its browser. Mobile numbers are kept there only as a scrambled code, not as the number itself. Check-ins made offline are sent the moment the signal returns. When the event is over, staff can simply close the link; we recommend using phones your team controls.

6. Email and text messages

• Nothing is sent to guests until you press Send. Reminders and follow-ups are switched off until you turn them on.
• When a guest replies to an invitation, the reply goes to you, not to us.
• Text messages are sent only when you press Send, only between 8am and 8pm, and carry just the guest's first name and their pass link.

7. Your own systems (Zapier, Cvent, your CRM)

You can import guest lists exported from Cvent, Eventbrite or a spreadsheet, and you can choose to send each check-in to your own system through a web address (for example a Zapier or Make webhook). Only https addresses are accepted, and they cannot point at private networks. Where that data goes after it leaves us is your choice and under your control.

8. Keeping and deleting data

• Your guest data stays until you delete the event or your account.
• Deleting an event deletes its guest list, door log, feedback and exhibitor leads.
• Closing your account deletes every event on it.
• Want everything removed after your event? Ask us and we will confirm in writing when it is done.

9. If something goes wrong

If a breach puts personal data at risk, we will tell you without delay, give you what we know so you can inform your guests, and notify the National Privacy Commission within 72 hours as its rules require.

10. Contracts and questionnaires

• You are the personal information controller and Strong Media Corp is your processor. Section 8 of our Terms of Service is the data-processing agreement.
• Need your own data-processing agreement signed, or a security questionnaire answered? Send it to us — we reply within 5 working days.
• See also our Privacy Policy.

11. Contact

Strong Media Corp
Marikina City, Metro Manila, Philippines
strongmediacorp@yahoo.com