Vihaya Events handles two things people are right to be careful about: money, and attendee personal data. This page states plainly what we do with both, what we hold, and — just as importantly — what we do not claim.
1. Where your data lives
All event, registration and account data is stored in Google Cloud Firestore in the asia-south1 (Mumbai) region. Uploaded files — event posters, certificate templates, speaker photos — are in Google Cloud Storage. Nothing is replicated outside India by us.
2. Encryption
- In transit: every request is served over HTTPS. We send an HTTP Strict-Transport-Security header with a two-year max-age,
includeSubDomains and preload, so a browser that has seen the site once will refuse to talk to it unencrypted. - At rest: Firestore and Cloud Storage encrypt all data at rest with AES-256 by default, managed by Google Cloud. We do not operate our own storage layer.
- API keys: developer API keys are stored as a SHA-256 hash. The key itself is shown once, at creation, and is not recoverable from our database afterwards.
3. Payments — what Razorpay handles, and what we store
Card, UPI and net-banking details are entered into Razorpay's own checkout and are never sent to, processed by, or stored on our servers. Razorpay is an RBI-authorised payment aggregator and is PCI-DSS certified; we are not, and we do not need to be, because we never touch card data.
What we store against a registration is:
- the amount paid, the currency, and the payment status;
- Razorpay's own order and payment identifiers, which are references, not credentials;
- the details the organiser asked for on their registration form.
Every payment confirmation is verified with an HMAC-SHA256 signature against a server-only secret before a ticket is issued, and the amount is read back from Razorpay rather than trusted from the browser. Razorpay webhooks are signature- verified the same way and rejected outright if the secret is not configured.
4. Access control
- Sign-in is handled by Firebase Authentication. We never store a password.
- Attendee and registration data is protected by server-side Firestore Security Rules, not by the user interface. An organiser can read their own events' registrations and nobody else's, and that is enforced at the database.
- Organisers can delegate per-event and per-track roles — a volunteer on a gate desk can check people in without being able to edit the event, issue a refund or export the roster.
- Sensitive actions — event publish and unpublish, refunds, access grants and revocations, broadcasts — are written to a per-event activity log that is append-only at the database level: nobody, including us, can edit or delete an entry.
5. Application hardening
- A Content Security Policy restricts which origins may load scripts, frames, fonts and styles, and blocks inline objects entirely.
X-Content-Type-Options: nosniff, a referrer policy, and frame-ancestor restrictions are set on every response.- Dependencies are audited and kept current; the build fails on type or lint errors.
- Errors are reported to Sentry with payment identifiers but never attendee names, emails or phone numbers.
6. DPDP Act, 2023
India's Digital Personal Data Protection Act is the law that applies to us, and we operate on its terms:
- Purpose limitation. Data an attendee gives an organiser is used to deliver that registration — the ticket, the gate, the certificate. We do not sell it, and we do not use attendee data to market to them.
- Roles. For an event's registration data the organiser is the Data Fiduciary and Vihaya is the Data Processor. For your Vihaya account itself, we are the Fiduciary.
- Your rights. Access, correction and erasure requests go to privacy@vihaya.app and are answered within 30 days.
- Retention. Registration and payment records are kept while they are needed for the event, for tax and accounting obligations, and for dispute resolution.
The full detail is in our Privacy Policy.
7. What we do not claim
We would rather be useful than impressive, so, explicitly:
- We are not ISO 27001, SOC 2 or PCI-DSS certified. No audit has been performed against those standards. Our payment provider is PCI-DSS certified; we are not, and any page that told you otherwise would be wrong.
- We do not publish an uptime SLA. We run on Vercel and Google Cloud and inherit their availability, but we have not committed to a figure and will not quote one we cannot stand behind.
- We have not commissioned an external penetration test.
8. Reporting a vulnerability
Email security@vihaya.app with steps to reproduce. We aim to acknowledge within two working days. Please give us a reasonable window to fix an issue before disclosing it, and please do not run automated scans against a live event — there are real attendees behind these pages.
For anything else, including data-protection requests, contact us.