Security
Last updated:
Security is a core part of how we build HOCOplus. This page describes the practices we follow to protect your data. We describe what we actually do — we do not claim certifications or audits we have not completed.
Encryption
All traffic to and from the Service is encrypted in transit using HTTPS/TLS. Data stored in our managed database and file storage is encrypted at rest by our infrastructure providers.
Payments
Paid ticket checkout is handled on the secure, hosted pages of our PCI-compliant payment provider (Stripe). HOCOplus never receives or stores your full card number. Host and vendor payouts are processed through the provider's connected-account system, so sensitive banking details are collected and held by the provider, not by us.
Access control
We enforce data isolation at the database layer using row-level security, so each account can access only the data it is authorized to see. Internal access to production systems follows least-privilege principles, and administrative functions are restricted.
Authentication
Passwords are stored using industry-standard one-way hashing — never in plain text. Sessions are managed with signed tokens. We continue to expand account-security options over time.
Infrastructure
The Service runs on established cloud infrastructure with edge protection, including denial-of-service mitigation and a web application firewall, in front of our application. Our database is a managed service with automated backups.
Data minimization
We collect only the information needed to operate the Service, and we do not sell personal information. See our Privacy Policy for details on what we collect and why, and our Cookie Policy for how we handle cookies and storage.
Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability in the Service, please report it to us through our contact page with enough detail to reproduce the issue. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access or modify data that is not yours. We will acknowledge legitimate reports and work in good faith to resolve them.
Honest limitations
No product or service is perfectly secure. We apply reasonable, layered safeguards and improve them over time, but we cannot guarantee absolute security. Keeping your account credentials confidential is an important part of protecting your data.
Contact
Security questions or reports? Reach us through our contact page.