Security

1. Sign-in without a password

The platform has no passwords. You sign in with Google, Apple or a passkey (fingerprint, Face ID, hardware key).

This is safer: we do not store passwords, so they cannot be stolen from us. The most common way accounts get hacked, when the same password is guessed from a database leaked from another service, simply does not work here.

2. Encryption

• All connections to the platform are protected by TLS. Data between your device and the server is never sent in plain text.
• Sensitive data in the database (integration keys, tokens of payment and POS systems, bot credentials) is encrypted with AES-256-GCM. Even with access to the database, it cannot be read without a separate key.
• We do not store bank card details. Payment takes place on the bank's side, and the platform keeps only the masked number and a payment token that cannot be used outside AOA.

3. Who sees what

Access within a venue or organization team is granted by roles and individual permissions: analytics, creating events, bookings, products, orders, payments, team management. Each permission is turned on separately.

What this means in practice for a business: a waiter can welcome guests and scan tickets without seeing financial reports; an event manager gets no access to payment settings. When an employee leaves, you remove their access in one click, and it stops working immediately, including active sessions.

Every action that changes permissions or a role is recorded in a log. Permissions are checked on the server with every request, not only in the interface, where buttons can be hidden.

4. Money does not pass through us

Payments for tickets and products go directly to the account of the venue or organizer through the bank's acquiring. AOA is not an intermediary wallet and does not hold your money.

For a business, this means your money does not depend on our solvency and does not wait for a payout. For a guest: payment data is processed by the bank, not by us.

Every message from the payment system is verified by its digital signature. A message without a valid signature is rejected, so a "payment" that never happened cannot be faked from outside.

5. Backups

• A full copy of the database is made every night.
• The copy is kept not only on the main server but also in separate storage outside it. A server failure does not mean data loss.
• Every week, an automatic check confirms that the latest copy is intact, not empty and contains the expected data.

The maximum amount of data that can be lost in a total failure is one day.

6. Data is not kept forever

Personal data is deleted automatically once there is no longer a reason to keep it. Deletion runs automatically every day. Main retention periods:

• Sign-in attempt logs: 30 days
• Technical records of entry to premises: 30 days
• Anonymized page visit statistics: 90 days
• Contact details from incomplete orders: 90 days, after which they are anonymized (only the amount remains for reporting)
• Messages in venue rooms: 180 days
• Payment and ticket records: up to 3 years, as required by accounting law

7. Your account is under your control

• The settings show all active sessions and devices. Any of them can be ended remotely.
• You can delete your account yourself, without contacting support. Your personal data is deleted together with it.
• We do not sell personal data or share it with third parties, except for the services needed to run the platform. All of them are listed by name in the Privacy Policy.

8. How we monitor the system

• The code is checked by automated vulnerability scanning tools, and third-party libraries are checked against a database of known threats.
• The platform is monitored around the clock. Some failures are fixed automatically, and the rest immediately trigger an alert to the person responsible.
• Security updates are installed on the servers automatically. Server access is possible only with a cryptographic key; password sign-in is turned off.

9. If you have found a vulnerability

Write to us at security@aoa.com.ua. We handle such reports as a priority.

Please do not publish your finding before we have fixed it, and do not go beyond verification: do not download other people's data, do not modify or delete it, and do not run load attacks. If you follow these conditions, we have no claims against researchers.

Machine-readable contacts are published at /.well-known/security.txt.

Contacts