Security your InfoSec team can sign off
Event data is personal data, often for senior people at large organisations. Here is how Delekit protects it, in plain terms, so your security review moves quickly.
Certified and compliant
- Cyber Essentials certified
- UK GDPR and Data Protection Act 2018 compliant
- Delekit acts as data processor, you remain the controller
- Working towards ISO 27001 certification
UK hosting and resilience
- Platform infrastructure hosted in the United Kingdom
- Databases replicated live to a second availability zone
- Web application load balanced across multiple availability zones
- Daily backups retained for 35 days
Access and authentication
- Two-factor authentication required on every account
- Invite-only accounts, locked after repeated failed sign-ins
- Role-based access control, per client and per event
- Attendee data scoped per client, with no cross-client access
Network and monitoring
- Encrypted connections using TLS
- Cloudflare in front of the platform, including web application firewall
- Error monitoring and uptime monitoring
- Full audit history on attendee records
Devices onsite
- Hire devices centrally managed with Microsoft Intune and Entra
- Devices factory reset onsite before return
- Lost credentials disabled in seconds
Transparency
- Published attendee privacy notice and attendee terms
- Sub-processors listed: AWS, Cloudflare, Microsoft, Stripe
- Responsible disclosure at security@delekit.com
- Security and ESG policies available for supplier onboarding
Live platform status and uptime history are published at status.delekit.com.
Security questions
Where is attendee data stored?
Platform infrastructure is hosted in the United Kingdom. Our sub-processors are listed in the attendee privacy notice.
Who is the data controller?
For events run on Delekit, the event organiser is the data controller and Delekit Ltd is the data processor. We process attendee data only on your instructions.
Can you complete our supplier security questionnaire?
Yes. Send it over with your procurement pack. We can also share our security, privacy and ESG policies and our Cyber Essentials certificate.
Do you support single sign-on?
Not at the moment. Every account must use two-factor authentication with an authenticator app, accounts are created by invitation only, and you can see and sign out of active sessions at any time.
Are you ISO 27001 certified?
Not yet. Delekit is Cyber Essentials certified and is working towards ISO 27001 certification. Ask us for the current timeline.
How do I report a vulnerability?
Email security@delekit.com with the details. Please do not test the platform outside of that process.
Need the paperwork?
We will send our security and privacy documentation and complete your supplier questionnaire.