1. Architecture
Everlage is a multi-tenant platform with strict tenant isolation: every query is scoped to the tenant, storefronts run under separate origins, and theme previews are sandboxed so tenant code never reaches the operator chrome.
2. Encryption
TLS 1.2+ everywhere in transit; AES-256 encryption at rest for databases and backups. Payment card data never touches Everlage servers — checkout is handled by your connected, PCI-DSS-compliant payment provider.
3. Ticket integrity
Every ticket carries a unique, signed QR code. Validation succeeds only through authorized scanner sessions bound to the correct account and event, and a code that has entered cannot enter again — screenshots don't get a second admission.
4. Access control
Role-based permissions for operator teams, per-device scanner credentials you can revoke, and audit logs on sensitive actions (refund records, exports, permission changes).
5. Availability
Redundant infrastructure with automated failover, continuous backups and a 99.9% uptime objective. Live component status is published on the Status page and inside the console.
6. Responsible disclosure
Found a vulnerability? Email contact@everlage.com with reproduction steps. We acknowledge within one business day, and we don't pursue good-faith researchers.
