Conference DeskSecurity and data
Your conference’s data is yours. Here is where it lives, who can see it, how you take it with you, and what we send your university or society before you buy.
Where it lives
The database and uploaded files are hosted in the EU, in Stockholm, Sweden. Email is sent from the EU, in Ireland. The website runs on Cloudflare.
Who can see what
Each person sees only what their role allows. A reviewer sees only their assigned papers; authors see only their own. The chair decides who joins the committee.
On the record
Votes, decisions and changes are kept in an audit log that the committee can read and export.
Yours to take
Export submissions, registrations, people, partners, tasks, expenses, invitations and the audit log as spreadsheet files at any time. Nothing is locked in.
Never locked out
We never lock an organiser, reviewer or author out in the middle of a conference over a plan, a limit or a payment. If something needs settling, we talk to you and the conference carries on.
Card details
When card payments start, they will go through Stripe. Conference Desk never sees or stores card numbers, and conference pages cannot ask for them.
Services we use
Each is bound by a data processing agreement and acts only on our instructions. We give organisers 30 days’ notice before adding or replacing one.
| Service | What it does | Where |
|---|---|---|
| Cloudflare | Website hosting, delivery and protection | Global network |
| Supabase | Database, file storage and sign-in | EU (Stockholm, Sweden) |
| Resend | Invitations, confirmations, decisions and invoices by email | EU (Ireland) |
| Stripe | Card payments, once they start | EU (Ireland) and United States |
| Expo, Apple and Google | App alerts. Lock-screen alerts never show names, paper titles or amounts. | United States |
Cloudflare, Supabase, Resend, Expo, Apple and Google are United States companies, so some data, such as support access or app alerts, may leave the UK and EU. For those transfers we rely on the UK–US data bridge where the company is certified to it, or else on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. The privacy notice has the full list.
Data processing agreement
For delegates’, authors’ and reviewers’ data, your organisation is the controller and we are its processor. The data processing agreement is Schedule 1 of our Terms and applies on every plan, including the free Starter plan. It covers our security measures, sub-processors, transfers, breach notice within 48 hours, help with people’s rights and impact assessments, and deletion at the end.
Signing in
People sign in with their email and a password or a 6-digit code, or with Apple or Google. The app can be locked with Face ID.
Hosted conference pages
Free hosted pages attract people who want to copy real conferences, so publication is earned:
- New conferences are private drafts, hidden from search engines, until we have reviewed and approved them.
- Pages show only what organisers type into set fields. There is no custom HTML, no scripts, no embedded content, no sign-in forms and no payment fields.
- Links to outside sites must be secure, and each one shows where it leads.
- Email goes out only from our own templates, and only once a conference is approved, apart from committee invitations.
- Every hosted page says it is hosted by Conference Desk and how to report abuse. Reports to [email protected] are looked at within 24 hours, and we can take a page down at once.
Accessibility
We build the website, the dashboard and the app to WCAG 2.2 AA. Our accessibility statement sets out how we test and the issues we know about.
Certification
Cyber Essentials certification is planned, as the scheme many UK universities assess suppliers against. Until then, the procurement pack answers the same questions in full.
The procurement pack
University and society checks take weeks, and the academic who asked for the software usually does the chasing. Ask for the pack and you can hand it straight to your finance and IT offices.
- Security answers: a completed supplier security questionnaire.
- Data protection: input for your data protection impact assessment, and our data processing agreement.
- Supplier details: our legal and company details, bank details for invoices, and how to raise a purchase order.
- A formal quote your finance office can raise a purchase order against.
Ask for the pack and a formal quote
We reply within one working day.