Security practices
Security buyers reference this summary when mapping Trade Fair Wala controls to their internal questionnaires; deeper evidence appears under NDA in customer trust packets mirroring SOC2 Type II, ISO 27001 alignments, PCI SAQ references for card-present experiments.
Trust center snapshot · redacted secrets
Identity, access & privileged break-glass procedures
Workforce SSO enforces phishing-resistant MFA for every role; contractors inherit least privilege expiring weekly unless extended with manager attestation. Break-glass vault entries require dual approvals, ephemeral session recordings, Slack bridge notifications referencing change tickets tied to Sev1 incidents.
Product security & SDLC checkpoints
- Design reviews classify data flows across new marketplace modules referencing STRIDE diagrams.
- SAST/DAST pipelines block merges until critical/high issues resolved or risk accepted by security committee minutes.
- Dependency automation opens PRs when CVSS ≥7 exploitable chains discovered; emergency cherry-picks bypass standard freeze windows.
- Feature flags gate risky beta modules to allowlist tenants with signed pilot waivers.
- Secret scanning prevents pushes containing live API keys—even for internal sandboxes lacking network ACLs.
- Mobile apps undergo store compliance scans plus on-device tamper telemetry.
- Hardware security modules anchor customer-managed key pilot programs referencing BYOK KMS APIs.
- Incident simulations rotate cross-team war games mirroring ticketing surge + DDoS blends.
Detection, response & customer notification promises
SIEM correlations cross-reference payment anomalies, infra metrics, insider risk heuristics. Playbooks classify ransomware, supply-chain npm compromises, targeted organizer phishing bridging vendor email gateways. Severity 1 breaches trigger executive SMS trees within minutes; downstream customer communications align with contractual notification riders citing preliminary vs confirmed facts distinctions.
Customer-facing security configuration catalog
Organizers tune IP allowlists for finance exports, SAML strict mode, watermarking attendee PDF agendas, kiosk firmware pinning verifying signed bundles, concierge chat legal hold toggles delaying message purges.
Vulnerability disclosure & bounty budgets
Critical remote code executions may qualify for pooled bounty payouts subject to reproducibility, responsible coordination window, abstaining from attendee data extraction proofs beyond minimal necessary payloads.