Security
How we protect your data
Security isn't an afterthought — it's built into every layer of AttendPad.
1. Data Encryption
- Field-level AES-256-GCM encryption for attendee and member details (names, emails, phone numbers, organizations, custom fields, notes, signatures)
- Per-account key derivation using HKDF — each account's attendee data is encrypted with its own derived key and a fresh random IV per field
- HMAC-SHA256 hashing for email duplicate detection without exposing plaintext
- TLS encryption for all data in transit between your browser and our servers
- Kiosk PINs hashed with HMAC-SHA256 — never stored in plaintext
2. Authentication
- Powered by Better Auth with Google OAuth and email/password sign-in
- Email verification via one-time passcode (OTP) for new accounts
- Two-factor authentication (TOTP) with authenticator app support
- Backup codes for account recovery
- 2FA required for admin access
- Session revocation — sign out all other devices from account settings
3. Access Control
- Ownership checks on every database query — data is scoped to the account that owns it and the team admins it has invited
- Admin role enforcement with 2FA requirement for elevated access
- Kiosk PIN verification performed server-side with rate limiting (brute-force protection)
- Subscription-based feature gating enforced at the server level
4. Input Protection
- Rate limiting on public endpoints — check-ins, sign-in and sign-up, contact forms, photo uploads, and PIN attempts
- Honeypot fields to silently reject bot submissions
- CSRF protection — SameSite session cookies, plus Origin/Referer validation on check-in and room endpoints
- Cloudflare Turnstile captcha on sign-up, sign-in, and contact forms
- Input sanitization — control characters, null bytes, and oversized inputs are stripped
- Custom field limits (max 100 per sheet) to prevent DoS
5. Privacy
- GDPR data export — download all your data as JSON from account settings
- Full account deletion with cascade — removes all sheets, rooms, attendees, and auth data
- Automatic deletion of attendance sheets one year after creation
- We never sell, share, or use your attendance data for advertising
- You own your data — export or delete it at any time
- Audit logging for security events and compliance
6. Infrastructure
- Cloudflare Workers — every request runs in an isolated V8 isolate, with no servers for us to patch
- D1 database, encrypted at rest by Cloudflare underneath our own field-level encryption
- R2 object storage, encrypted at rest by Cloudflare, for logos and check-in verification photos
- Global CDN with built-in DDoS protection
- Security headers on every response (HSTS, CSP, X-Frame-Options, and more)
- Content Security Policy restricting where scripts, styles, frames, and connections can load from
Questions about our security practices?