Security at Konvener
Konvener is a live participation layer for meetings and workshops. Security and privacy are part of the product, not an afterthought.
Encryption in transit
All traffic is served over HTTPS/TLS with HSTS. Connections are upgraded to HTTPS and downgrades are refused.
Minimal participant data
Participants join with only a first name and institution — no email, password, or account. We collect the least we can.
No tracking cookies
Konvener sets one essential login cookie for organizers. No advertising, analytics, or third-party tracking cookies — ever.
Least-privilege access
Organizers see only their own workshops; participants see only their own workshop. Admin functions require an explicit, verified admin session.
Structured error logging
Errors are logged in full server-side with a correlation ID. Users only ever see a generic message — never a stack trace, path, query, or version.
Strict content security
A per-request nonce Content-Security-Policy blocks injected and inline scripts. The app loads no third-party scripts on any page.
Rate limiting & brute-force defence
Login attempts are rate limited per IP and per account, and every attempt is recorded for detection.
Your data, your control
Request deletion and we deactivate immediately, produce a full data report within 24 hours, and permanently erase everything after a 60-day retention window.
Data we collect
For participants: a first name and institution, plus the questions, comments, feedback, expectations and evaluation they choose to submit during a workshop. For organizers: an email, a securely hashed password, and the workshops they create. We do not collect payment details in the app; billing is handled by our payment processor.
How data is protected
- In transit: HTTPS/TLS everywhere, with HTTP Strict Transport Security.
- At rest: hosted on managed infrastructure with database access restricted to the application. Passwords are hashed with bcrypt; secrets live in the platform's secret store, never in code or the repository.
- In the browser: a strict Content-Security-Policy, secure/httpOnly cookies, and no third-party scripts on any page that handles credentials.
Access control
Every request is authorised against the requester's identity. Organizers can only read and change their own workshops; participants can only act within the workshop they joined; administrative functions require a separately verified admin session with role-based checks and are fully audit-logged.
Reliability & monitoring
Errors are captured with full context server-side and given a reference ID, while the user sees only a generic message. Security-relevant events — login attempts and administrative actions — are recorded and searchable.
Responsible disclosure
If you believe you've found a security issue, please email security@konvener.app with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure. We do not take legal action against good-faith research that respects our users' privacy and data.
docs/SECURITY-AUDIT.md).