Security & Trust
How we protect your data
This page describes the security measures CelebrityPass actually implements today. We do not claim to be “100% secure” or “impossible to hack” — no service can promise that. Instead, we are transparent about what we do and how you can hold us accountable.
Encrypted connections (HTTPS/TLS)
All traffic between your device and CelebrityPass is served over HTTPS with valid TLS certificates, protecting data in transit.
Hashed passwords
Account passwords are never stored in plain text. They are hashed with a per-account salt using scrypt, and verified in constant time.
Signed session cookies
Login sessions use cryptographically signed cookies that are HttpOnly, SameSite=Lax, and flagged Secure in production so they only travel over HTTPS.
Protected admin access
Admin areas require a separate login with password and two-factor authentication (TOTP). Admin-only server actions check the session server-side.
Rate limiting
Login, registration, contact, and data-request endpoints are rate limited per IP to slow automated abuse and brute-force attempts.
Server-side database access
The database is accessed only through server-side code. Client code never receives database credentials.
Manual payment verification
Bank-transfer payments are never automatically marked paid. A staff member verifies the receipt before a card or ticket is issued.
Controlled error handling
Server errors are handled without exposing database details or personal information to users.
What we do not claim
We do not claim CelebrityPass is certified, government-approved, or officially verified by any third party. We do not use phrases like “military-grade” or “100% secure.” No method of transmission or storage is completely secure, and we encourage you to use a strong, unique password and to enable two-factor authentication on your accounts where available.
Your responsibilities
- Use a strong, unique password and do not reuse it elsewhere.
- Never share your password or authentication codes with anyone.
- Notify us promptly if you believe your account has been compromised.
Account deletion and your data
You can request access to, correction of, export of, or deletion of your personal data through our User Rights & Data Requests page. If you are signed in, you can also delete your account directly from Account Settings.
Reporting a security concern
If you believe you have found a security issue or a vulnerability, or if you suspect your account has been compromised, please contact us through our Contact & Support page and choose the Security category. We will prioritize and review your report.