Security at Konvener
Konvener is a live participation layer for meetings and workshops. Security and privacy are part of the product, not an afterthought.
At a Glance
Encryption in transit
All traffic is served over HTTPS/TLS with HSTS. Connections are upgraded to HTTPS and downgrades are refused.
Minimal participant data
Participants join with only a first name and institution, no email, password, or account. We collect the least we can.
No tracking cookies
Konvener sets one essential login cookie for organisers. No advertising, analytics, or third-party tracking cookies, ever.
Least-privilege access
Organisers see only their own workshops; participants see only their own workshop. Admin functions require an explicit, verified admin session.
Structured error logging
Errors are logged in full server-side with a correlation ID. Users only ever see a generic message, never a stack trace, path, query, or version.
Strict content security
A per-request nonce Content-Security-Policy blocks injected and inline scripts. The app loads no third-party scripts on any page.
Rate limiting & brute-force defence
Login attempts are rate limited per IP and per account, and every attempt is recorded for detection.
Your data, your control
Request deletion and we deactivate immediately, produce a full data report within 24 hours, and permanently erase everything after a 60-day retention window.
Data we collect
For participants: a first name and institution, plus the questions, comments, feedback, expectations and evaluation they choose to submit during a workshop. For organisers: an email, a securely hashed password, and the workshops they create. We do not collect payment details in the app; billing is handled by our payment processor.
How data is protected
- In transit: HTTPS/TLS everywhere, with HTTP Strict Transport Security.
- At rest: hosted on managed infrastructure with database access restricted to the application. Passwords are hashed with bcrypt; secrets live in the platform's secret store, never in code or the repository.
- In the browser: a strict Content-Security-Policy, secure/httpOnly cookies, and no third-party scripts on any page that handles credentials.
Access control
Every request is authorised against the requester's identity. Organisers can only read and change their own workshops; participants can only act within the workshop they joined; administrative functions require a separately verified admin session with role-based checks and are fully audit-logged.
Reliability & monitoring
Errors are captured with full context server-side and given a reference ID, while the user sees only a generic message. Security-relevant events, login attempts and administrative actions, are recorded and searchable.
Responsible disclosure
If you believe you've found a security issue, please email security@konvener.app with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure. We do not take legal action against good-faith research that respects our users' privacy and data.
docs/SECURITY-AUDIT.md).