Data Protection

This page describes technical and organisational practices in the standard INVYRA software. It does not claim certification under any named regulatory framework.

Access control

Organiser routes require an authenticated session. Event records are limited to the owning host. Public invitation routes expose only information needed to RSVP.

Sensitive attendee information

Parent/guardian details, consent tokens, emergency contacts, medical notes, and similar fields are stored on guest records for authorised hosts. They are omitted from public event payloads.

Passwords and sessions

Passwords are hashed. Sessions use signed cookies. Secrets must never be placed in frontend environment variables.

Uploads

Poster and file uploads are size- and type-checked. Operators should not place private files on an open CDN without access control.

Logging

Server logs are intended for diagnosis. They should not include passwords, database URIs, or session secrets.

Operator duties

The organisation that deploys INVYRA is responsible for infrastructure security, backups, retention, and any legal assessments required in their jurisdiction.