Your attendees trust you. You can trust us.
Tikitfy processes hundreds of millions of euros in ticket revenue a year. Here is how we protect the money, the data and the door.
Certifications and frameworks
ISO 27001
Information security management system audited annually by an accredited body.
PCI DSS
Card data is tokenised by our Level 1 processor; it never touches Tikitfy servers.
GDPR
EU-hosted, DPA available for every customer, DPO on staff, sub-processor list published.
SOC 2 Type II
Observation period underway; report expected Q1 2027.
How we protect the platform
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest, HSM-backed key management with automatic rotation.
SSO, 2FA and roles
SAML/OIDC single sign-on, enforced two-factor for admins, and granular per-event permissions for door staff.
24/7 monitoring
Centralised logging, anomaly detection on checkout traffic and an on-call engineer every hour of the year.
Independent pen tests
Two external penetration tests a year plus continuous automated scanning. Summary reports available under NDA.
Backups and recovery
Point-in-time recovery, encrypted backups in a second EU region, quarterly restore drills. RPO 5 min, RTO 1 hour.
Bot and fraud defence
Queue-it style waiting rooms on high-demand on-sales, device fingerprinting and 3-D Secure to keep tickets with real fans.
Where your data lives and how long
Production runs in Amsterdam with failover to Frankfurt. Attendee personal data never leaves the EU, and we sign a Data Processing Agreement with every organizer — you are the controller, we are the processor.
Attendee data is retained for the life of your account and deleted within 30 days of closure or on request. Exports in CSV and JSON are available at any time from the dashboard or API.
Card numbers are handled entirely by our PCI Level 1 payment processor. Tikitfy stores only a token and the last four digits.
Live platform status
Last incident: 14 Feb 2026, 11 min degraded API latency. Subscribe to updates at status.tikitfy.nl.
Found a vulnerability?
Email [email protected] (PGP key on request). We acknowledge within one business day, keep you updated at least weekly, and do not pursue legal action against good-faith research. Rewards from €150 to €5,000 depending on severity.
Need our security documentation?
Request our ISO certificate, latest pen-test summary, DPA and sub-processor list for your procurement review.