legal
security
perfect security doesn't exist. here's concretely what we put in place, what we don't claim to do, and how to report a flaw to us.
last updated : june 10, 2026
the essentials
- all traffic is encrypted (https), on the web and in the app.
- your password is hashed with bcrypt: even we can't read it.
- payments are handled by stripe (pci dss level 1 certified) - your card numbers never touch our servers.
- photos and media are never public: they're served through authenticated access or signed links with a limited lifetime.
- changing your password immediately signs out all your sessions.
- found a flaw to report? support@2gather.events, subject [security] - acknowledgement within 3 business days.
your data in transit and at rest
- all connections - website, app, api - go through https (tls).
- photos and media are stored at ovhcloud in roubaix (france) and are never publicly exposed: they're served through authenticated access, or through signed links that expire.
- passwords are hashed with bcrypt (with salt, adaptive cost); session tokens are stored only as a fingerprint (sha-256), never in clear text.
accounts and sessions
- sessions rely on short-lived access tokens, renewed by a refresh token that changes on every use - an already-used token is rejected.
- changing your password revokes all your sessions, on every device. signing out immediately invalidates the current token.
- sign-in attempts are rate-limited to block brute force, and disposable email addresses are refused at sign-up.
payments
payments are handled entirely by stripe, certified pci dss level 1 - the most demanding level of the banking standard. your card numbers never pass through our servers and we don't store them.
platform protection
- strict security headers (content-security-policy, clickjacking protection) and rate limiting across the whole api.
- systematic validation and sanitization of all inputs, automatic filtering of plainly inappropriate content.
- the web api only accepts known origins - the list is checked when the server starts.
- continuous error monitoring, with automatic masking of sensitive fields (passwords, tokens) before anything is sent.
protect your account
- use a long, unique password - ideally generated by a password manager.
- we will never ask you for your password, neither by email nor by message. check that the address is indeed 2gather.events before signing in.
- account compromised? change your password immediately - this signs out all sessions -, then write to us at support@2gather.events (subject [security]).
- a member behaving suspiciously? report or block them from the app - every report is read by a person.
your data
deleting your account erases your data immediately and permanently - the details are in the privacy policy. if a data breach posed a risk to you, we would notify the cnil within 72 hours and inform you without delay.
report a vulnerability
think you've found a flaw? write to us (subject [security]) describing the url or feature concerned, the steps to reproduce, and the estimated impact. in french or in english, and anonymously if you prefer. this information is also published in our security.txt.
scope - the 2gather.events website, the api, and the 2gather mobile app. out of scope: third-party services (stripe, hosting providers, google), denial-of-service attacks, social engineering targeting our members, and automated scanner reports without demonstrated impact.
rules of the game - test only with your own accounts; keep to the minimal proof of concept, without extracting or altering other members' data; if you come across personal data, stop and warn us; let us fix it before any disclosure (90 days at most, or a delay agreed together).
our commitments - acknowledgement within 3 business days, a first assessment within 7 days, a fix targeted within 90 days, and your name in our acknowledgements if you wish. we don't run a reward program (bug bounty). if your report reveals a personal data breach, we take on our gdpr obligations (cnil notification within 72 hours).
good faith - if your research respects these rules, we consider it authorized: no complaint, no civil action. this commitment can bind neither third parties nor the public prosecutor. you can also report any vulnerability to anssi (cert-fr), which preserves the confidentiality of your identity (article L. 2321-4 of the defence code).
what we don't claim
no system is perfectly secure, and we claim no certification we don't hold. what we do guarantee: the measures described on this page are genuinely in place, and if an incident affected your data, you would be informed without delay.