Version 2026-10-09 · Effective October 9, 2026

Security and Responsible Disclosure

How Eventloom protects the service, and how to report a security problem.

How we protect Eventloom

We keep each host's data separate with access controls, require multi-factor authentication for sensitive actions, use HTTPS and encrypted storage, hash IP addresses, keep logging to a minimum, rate-limit public forms, check payment notifications are genuinely from Stripe, scan our dependencies for known vulnerabilities, and review changes before they reach production.

Report a vulnerability

Email hello@eventloom.co with "Security" in the subject. Include the affected page or link, steps to reproduce, the impact, and how to contact you. We will acknowledge your report within 5 business days and keep you updated.

Rules for research

Only test against your own account and events. Don't access, change or delete other people's data, don't degrade the service (no denial-of-service or heavy automated scanning), don't use social engineering or phishing, and don't publicly disclose an issue until we have fixed it or 90 days have passed, whichever is first. If you follow these rules and act in good faith, we will not pursue legal action against you for your research. We don't currently offer paid bug bounties.