Security

Last updated 5 October 2026. Operated by Needs your details — set entity in src/lib/legal.ts.

Card payments

Card details are entered only on the payment provider's own pages, Stitch or Paystack. Tikit never receives, stores or sends a card number. That keeps Tikit within PCI DSS SAQ-A scope, which is a self-assessment, not a certification.

What protects your data

• Every page is served over HTTPS, and browsers are told to insist on it (HSTS).
• Passwords and door staff PINs are stored hashed, never as typed.
• Ticket QR codes are signed, so a code that was not issued by Tikit does not scan.
• Team access is by role: an owner, a manager and door staff each see only what their role needs.
• Pages send security headers, including a content security policy that currently reports problems without blocking anything, and they cannot be shown inside another website's frame.

What Tikit watches

• Technical error reports, with emails, phone numbers, ticket codes and sign-in links removed before they leave Tikit, when the operator has switched error tracking on.
• An alert to the operator when a payout, a refund or a ticket delivery fails.
• Automatic health checks of the database, background jobs, email and payments.
• A public status page that says whether Tikit is running and lists any incident.

What Tikit does not claim

Tikit does not hold a SOC 2 report or ISO 27001 certification.

Reporting a vulnerability

If you think you have found a security problem, write to Needs your details — set securityEmail in src/lib/legal.ts. Please give us a reasonable time to fix it before telling anyone else, and don't access anyone else's data. The same details are in our security.txt. Tikit does not run a bug bounty.