Security

Tickets, payments and guest details are only worth having if they are safe. This page says plainly what we do to protect them, and what we ask of you.

Everything between your device and Quiktis travels over an encrypted HTTPS connection.

• Passwords are stored as one-way hashes, never as plain text.
• New accounts confirm their email address.
• Changing your password uses a one-time code sent to your email.
• Removing saved payout details needs a one-time code as well.

• Card payments are handled by our payment partner, which is PCI-DSS compliant.
• Quiktis does not store your full card details.

• Every ticket has its own QR code, and can be checked in only once.
• Only the event's organiser and the staff they invite can scan tickets or see the guest list.
• Organisers can only manage their own events.

Access is limited by role, so people and systems can reach only what they need. We review our code and the systems we run on, and we fix security issues as we find them.

• We investigate suspected incidents straight away and contain them.
• We tell affected people and the authorities where the law requires it.

• Use a strong password you do not use anywhere else.
• Keep your ticket QR code private.
• Tell us straight away if you notice anything odd on your account.

If you find a security problem, email hello@quiktis.com with "Security" in the subject and enough detail for us to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data. We are grateful for responsible reports.