What Homestand actually does to protect event data and the people invited into it. We don't carry SOC 2, HIPAA, FERPA, or NCAA certifications, and we won't claim them — this page describes the real controls in place today.
Every query an organizer's session can run is filtered by organization id in the application layer. Row-level security policies for every tenant table ship with the schema and are exercised in our automated tests. One member's data is never reachable from another organization's session.
People outside your organization never create a login. Each link is tied to one participant's role on one event, expires, and can be revoked at any time. The link's token is stored as a hash, not in plain text, and lookups are rate-limited.
Sign-in uses a single-use, expiring magic link or a password (hashed with scrypt, never stored in plain text). Session cookies are signed server-side and re-check the member's role and organization on every request — demoting or removing someone takes effect immediately.
Participant uploads are scoped to the specific requirement they were submitted against, every file records a scan status, and every download is permission-checked on each request.
Incoming webhooks (billing, SMS, email) are signature-verified and processed idempotently. Content parsed from inbound replies or imported documents is treated as data — never as instructions — and AI-suggested changes are schema-validated and routed to human review before anything is sent or applied.
Deleting an event or contact soft-deletes it; changes to plans and requirements are written to an append-only change log rather than overwritten.