When you buy a ticket, apply to vend or practise, or share something with the community, you are trusting us with more than an email address. This page says exactly how that trust is protected — and what we have not built yet.
Your account
The whole site is served over encrypted connections. Your password is stored only as a one-way bcrypt hash: nobody at Sensorium can read it, and deleting your account needs it again, so a session left open on a shared computer is not enough to erase you.
Sign-ins are written to a security log with the time, device and approximate location, so an unfamiliar sign-in can be spotted and traced. The log records actions, never the content of your posts or messages.
Payments
Card details are typed into Stripe’s own secure field, which sends them straight to Stripe. They never reach our servers, so there is nothing here for anyone to steal. We keep Stripe’s reference for the payment and the amount, which is what a refund needs.
Every payment carries a unique key, so if your connection drops and you press Pay again, the second press is recognised as the same payment rather than a second charge. And the total you are shown is checked against the total we calculate before anything is charged: if the two differ, nothing is taken and you are asked to confirm the new amount. A refund is claimed before it is sent, so the same ticket can never be refunded twice.
Payouts and tax documents
Practitioners and team members who are paid a share are credited to their balance on the site by default. Anyone who chooses to be paid to a bank account gives their bank and identity details to Stripe directly, not to us. Each payout line is marked as claimed before money moves, so a retry or a second click cannot pay the same line twice.
Tax forms such as a Form W-9 are encrypted with AES-256-GCM before they are written to disk, checked against a fingerprint when they are opened so a damaged or altered file is refused, and can be opened only by the person they belong to and the people responsible for our taxes. Being able to see the finances is not enough on its own.
Privacy in the community
Vendor and practitioner profiles are built from the answers given when they applied. Contact details — email, phone, address and consent answers — are private by default, and what is hidden is removed on the server, before the page is sent, not merely hidden in your browser. A file uploaded with an application is only served if the profile actually shows it.
An event’s team page shows who is working where and when, and only to people on that team or running the event. It never shows anyone’s email address.
Deletion you can check
Deleting your account removes you from every part of the site, not only the obvious ones. What stays is set out in the Privacy Policy: the record of tickets sold and payments made, and the security log, because a history that a deletion could rewrite would protect nobody.
Where we issue a deletion certificate, it holds a fingerprint of the data that was destroyed, the time, and an ID, signed so that only we could have issued it. It carries no personal data, and anybody can check one at sensorium.events/verify-deletion without an account.
What we will not do
- We will not sell your information.
- We will not use your information to train any AI model, ours or anybody else’s.
- We will not share your information with advertising platforms.
- We will tell you about a breach affecting your information within 72 hours of confirming it.
The services we do use are named in the Privacy Policy, with what each one receives.
Not built yet, and said so
Your profile, posts and messages are protected by the server’s access rules and by encrypted connections, but they are not encrypted field by field in the database the way tax documents are. We are not SOC 2 certified, and there is no bug bounty programme.
None of those is true today, so none of them is claimed above.
Reporting something
If you have found a security problem on Sensorium Events, write to knowledge@sensorium.events with enough detail to reproduce it. We will confirm receipt and tell you what we are doing about it.
Last updated 24 September 2026.