Security & Trust

Card and M-Pesa payments are taken by Paystack. Card details are typed into Paystack's own checkout, so they never pass through or rest on Creve's servers.

Creve checks the signature on every payment notification before acting on it, and checks the amount paid against the ticket price, so a tampered notification or payment can't issue a ticket.

On Creve White Label, payments go to your own Paystack account. The secret key you connect is stored encrypted and is never shown again, to you or to anyone else.

Every page and request is sent over an encrypted connection (HTTPS), and browsers are told to use nothing else.

The most sensitive things Creve keeps are encrypted with AES-256: payment keys you connect, saved-card details for subscription renewals, two-step sign-in secrets and webhook signing secrets. Passwords are stored as one-way hashes (bcrypt), never as text.

Each organizer sees only their own events, attendees, sales and payouts.

You can limit each member of your staff to the events you choose.

Creve's own team works under roles that give each person only the access their job needs. Refund decisions and access changes are limited to senior administrators, and every action in Creve's administration tools is logged.

Passwords need at least eight characters with a letter and a number, and repeated wrong attempts are slowed down. Password reset links expire after an hour and work once.

You can turn on two-step sign-in, with an authenticator app or codes sent by email, and keep recovery codes in case you lose your phone. Set it up in Settings > Security.

Buying a ticket doesn't publish anyone. Appearing in an event's networking directory and sharing contact details are two separate choices each attendee makes, and can change.

Anyone can ask for a copy of their information, or for it to be corrected or deleted, through a privacy request. See the Privacy Policy for how Creve uses information.

API keys are shown once, when you make them, and Creve keeps only a scrambled copy. Each key can read only what you allow, and a test key never sees real records.

Every webhook message is signed, so your systems can check it came from Creve. The developer documentation explains how.

If you think you've found a security problem in Creve, open a support ticket from your dashboard with “Security” in the subject. Please don't access or change other people's information while looking into it.

This page describes the protections in place today, and changes as they do.