Data privacy, SSO and security compliance are no longer nice-to-haves for enterprise event buyers. Here are the questions your team should be asking every vendor before you commit.
Enterprise event teams have always had to think carefully about procurement. Vendor stability, support quality, and platform capability are standard evaluation criteria. But in 2026, a new category of question has moved from the bottom of the evaluation sheet to the top: data security and compliance.
This shift is not theoretical. IT and legal teams are now routinely blocking event technology purchases that cannot pass a security review. GDPR fines for data handling failures have reached levels that make procurement teams cautious. And as events collect increasingly rich attendee data, the risk profile of a poor technology choice has grown substantially.
The good news is that the right questions are not complicated. This guide gives enterprise event teams a clear framework for evaluating event technology on security and compliance grounds, along with a checklist to use in every vendor conversation.
Why has data security become a procurement filter for enterprise event teams?
Event technology now sits at the intersection of HR data, customer data, and attendee behaviour data, making it a material risk area for enterprise organisations rather than a peripheral one. A corporate conference registration form can collect names, job titles, dietary requirements, accessibility needs, and company affiliation. A post-event app can hold session attendance records, networking connections, and survey responses. Combined, this is a significant volume of personal data that requires proper governance.
Three factors have raised the stakes in recent years:
- Regulatory enforcement: GDPR enforcement in Europe and expanding state privacy laws in the US, including CCPA and its successors, have created real financial consequences for organisations that cannot demonstrate proper data handling. Event data is not exempt.
- Enterprise IT governance: Large organisations have introduced formal vendor risk management processes that apply to all software purchases, including event technology. A platform that cannot answer basic security questions is rejected at IT review stage, regardless of how well it performs as an event tool.
- Attendee expectations: Professionals attending corporate and association events are increasingly aware of their data rights and more likely to raise concerns about how their information is used. An organisation that cannot provide clear answers on data handling damages trust with its own members and clients.
“The question is no longer whether your event tech vendor is secure. It is whether they can prove it in a way your IT team will accept.”
Does GDPR apply to event registration and attendee data?
Yes, unambiguously. Event registration data is personal data under GDPR and equivalent privacy regulations, and organisations processing it must comply with all applicable requirements. This applies whether the event is internal or external, paid or free, in-person or virtual.
The categories of data typically collected at corporate events that fall under GDPR include:
- Identity data: Name, job title, organisation, professional registration numbers where collected.
- Contact data: Email address, phone number, postal address.
- Special category data: Dietary requirements and accessibility needs may reveal health information or religious beliefs, both of which are special categories under GDPR requiring explicit consent and additional safeguards.
- Behavioural data: Session attendance records, app usage data, poll responses, and networking connections are all personal data when linked to an identifiable individual.
Organisations must be able to demonstrate a lawful basis for processing each category of data, inform attendees of how their data will be used before collection, respond to subject access requests within 30 days, and delete data on request. The event technology platform used must support each of these obligations technically and contractually.
Where should event attendee data be stored, and why does it matter?
For organisations subject to GDPR, attendee data must be stored and processed within the European Economic Area or transferred outside it only under a valid legal mechanism. This is not a detail to be confirmed after contract signature. It is a question to ask before any commercial conversation proceeds.
What to establish with every vendor:
- Specific data centre location: “Our data is stored in Europe” is not sufficient. Ask for the specific country or region, and the name of the infrastructure provider. AWS eu-west-1 (Ireland) and a server in a data centre with no published location are not equivalent answers.
- Sub-processor locations: The vendor’s own servers may be in the right jurisdiction, but their sub-processors — email delivery platforms, analytics tools, payment processors — may not be. Ask for a full sub-processor list and confirm each one’s data handling location.
- Data transfer mechanisms: If any data is transferred outside the EEA or the UK, ask which legal mechanism applies: standard contractual clauses, adequacy decision, or binding corporate rules. Vendors who cannot name the mechanism clearly are not on top of their compliance obligations.
- US data residency: For US enterprise organisations, confirm whether data residency requirements under internal policy or applicable state law affect where attendee data can be processed. Some sectors, including healthcare and financial services, have specific requirements that generic cloud hosting does not meet.
Why do enterprise buyers require SSO, and what should you look for?
Single Sign-On is a security requirement for enterprise organisations, not a convenience feature. It ensures that access to the event platform is governed by the organisation’s own identity provider, subject to the same authentication standards — including multi-factor authentication — that apply to every other corporate system.
When an employee uses a separate account and password to access an event platform, three things go wrong from a security standpoint. Access is not automatically revoked when the employee leaves the organisation. The account is not subject to corporate password policy or MFA enforcement. And the IT team has no visibility of who has access to which data within the platform.
What to confirm with event technology vendors on SSO:
- SAML 2.0 support: The standard protocol for enterprise SSO. If a vendor does not support SAML 2.0, it will be blocked by most enterprise identity providers.
- OAuth 2.0 and OpenID Connect support: Increasingly used alongside SAML for modern identity provider integrations including Microsoft Entra ID (formerly Azure AD) and Okta.
- Scope of SSO coverage: Does SSO cover the event management back end only, or also the attendee-facing app? For internal corporate events, SSO for attendees is often a requirement.
- Just-in-time provisioning: The ability to create a user account automatically on first SSO login, without requiring manual account creation in advance. Essential for large internal events where pre-registering every attendee individually is impractical.
How does AI in event technology create new data security risks?
AI features in event platforms introduce a new category of data security question that most enterprise procurement checklists have not yet caught up with. Session recommendation engines, AI-powered networking tools, and chatbot assistants all process attendee data in ways that differ fundamentally from traditional event software. Understanding those differences is essential before signing a contract with any platform that has embedded AI into its core functionality.
The security concerns specific to AI in event platforms fall into three areas:
- Data used for model training: Some AI features are powered by models that are trained or fine-tuned using customer data. If a platform’s networking algorithm learns from your attendees’ profile information and behaviour, your organisation needs to understand: is that data used solely to serve your event, or does it also improve the vendor’s model for other customers? Under GDPR, using personal data for a purpose beyond the one disclosed to the data subject requires a separate lawful basis. A clear contractual answer is not optional.
- Third-party AI sub-processors: Vendors integrating AI capabilities often do so by embedding third-party large language models or AI APIs from providers such as OpenAI, Google, or Anthropic. Each of these is a sub-processor under GDPR. Enterprise teams should ask: which AI providers does the platform use, where do they process data, and are they listed in the data processing agreement? A vendor who says “we use AI” without being able to name the underlying provider has a compliance gap.
- Attendee profiling and inferred data: AI matchmaking and recommendation systems generate inferred data, drawing conclusions about attendees’ interests, seniority, and networking preferences from their stated profile and behaviour. This inferred data can be more sensitive than the original inputs. Ask vendors where inferred attendee data is stored, for how long, and whether it is deleted at the end of the event alongside the underlying source data.
The EU AI Act, which began applying to high-risk AI systems in 2025, adds a further compliance layer for organisations operating in Europe. While most event platform AI features sit outside the high-risk categories, enterprise teams should ask vendors whether they have assessed their AI features against the Act’s requirements and whether any AI-generated recommendations are disclosed as such to attendees.
What security certifications should an enterprise event platform hold?
The two certifications that carry the most weight in enterprise procurement are ISO 27001 and SOC 2 Type II, and both are worth asking for evidence of rather than simply accepting a vendor’s claim.
KEY SECURITY CERTIFICATIONS EXPLAINED
- ISO 27001: An internationally recognised standard for information security management systems. Certification requires an independent audit of security policies, controls, and processes. Ask to see the current certificate, which will include an expiry date and the scope of certification.
- SOC 2 Type II: An independent audit of security controls over a period of time, typically six to twelve months. Type II is significantly more meaningful than Type I, which only assesses controls at a single point in time. Ask for the most recent report and note the audit period and any exceptions noted.
- Cyber Essentials (UK): A UK government-backed certification covering baseline cyber security controls. Relevant for UK public sector and NHS procurement requirements.
- GDPR Data Processing Agreement: Not a certification, but a contractual requirement. Any vendor processing personal data on your behalf must sign a data processing agreement that meets GDPR Article 28 requirements. A vendor who does not offer a DPA is not compliant with GDPR.
- Penetration testing: Ask how frequently the platform undergoes independent penetration testing and whether summary results are available to customers. Annual penetration testing is a minimum standard for enterprise software.
What must a data processing agreement with an event tech vendor cover?
A data processing agreement is not a formality — it is the legal document that determines your organisation’s liability exposure if something goes wrong with attendee data. If a vendor cannot provide a DPA, or provides one that does not meet GDPR Article 28 requirements, the procurement should stop there.
A compliant DPA must cover:
- Categories and volume of personal data being processed, including any special category data such as dietary or accessibility information.
- Purpose and duration of processing, specifying that data is processed only to deliver the contracted services and for no other commercial purpose.
- Technical and organisational security measures, including encryption standards, access controls, and backup procedures.
- Sub-processor list and change notification process, including a commitment to notify the data controller before adding or changing sub-processors.
- Data subject request handling, confirming the vendor will support your organisation in responding to access, correction, and deletion requests within statutory timeframes.
- Data breach notification timeline, specifying that you will be notified within 72 hours of the vendor becoming aware of a breach — the GDPR requirement for notifying the relevant supervisory authority.
- Data return and deletion process, confirming how data will be returned or securely deleted at the end of the contract, and within what timeframe.
What should you ask event tech vendors about their data breach procedures?
A vendor’s response to the question “what happens if there is a data breach?” tells you more about their security maturity than any certification. A vendor with a clear, documented breach response process demonstrates that they have thought seriously about security. A vendor who is vague or who reassures you it will not happen has not.
BREACH RESPONSE QUESTIONS TO ASK
- What is your detection capability? How do you identify a breach, and how quickly can you typically detect unauthorised access to customer data?
- What is your notification timeline? GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach. Will you notify us within that window so we can meet our own obligations?
- What information will you provide in a breach notification? The notification should include what data was affected, how many individuals are involved, and what remediation steps are being taken.
- Have you experienced a breach in the last three years? This is a reasonable question to ask, and a vendor who refuses to answer it should be treated with caution. A breach that was handled well and transparently is less concerning than a vendor with no answer.
- What cyber insurance does the vendor carry? Relevant if your organisation’s procurement policy requires vendors to hold a minimum level of cyber liability coverage.
How does CrowdComms approach enterprise data security?
CrowdComms is built to meet the security and compliance requirements of enterprise organisations, with certifications, contractual commitments, and technical controls that pass IT security reviews without requiring exceptions.
For enterprise corporate event teams evaluating CrowdComms:
- ISO 27001 certified: CrowdComms holds ISO 27001 certification, with an independent annual audit of our information security management system. Current certificate available on request.
- GDPR compliant data processing: Core event data is stored within the UK and EEA; where sub-processors operate outside the EEA, transfers are governed by Standard Contractual Clauses. A fully compliant data processing agreement is available at contract stage and covers all GDPR Article 28 requirements.
- SSO via SAML 2.0: Full SSO support for the event management platform and, for internal corporate events, the attendee-facing app. Compatible with Microsoft Entra ID, Okta, and other major enterprise identity providers.
- Annual penetration testing: Independent penetration testing conducted annually, with findings remediated in line with our documented vulnerability management policy and severity-based SLAs.
- 72-hour breach notification commitment: Contractually committed to notifying customers within 72 hours of becoming aware of any security incident affecting their data.
- Data anonymisation: All client PII data is anonymised 6 months after the end of the event app.
Enterprise vendor security question checklist
Use this in every event technology vendor conversation. If a vendor cannot answer any of these questions clearly, that gap is a procurement risk.
VENDOR SECURITY QUESTION CHECKLIST
- In which specific country or region is customer data stored and processed?
- Does the vendor hold ISO 27001 certification and can they provide the current certificate?
- Does the vendor hold a SOC 2 Type II report and can they share the most recent audit period and any exceptions noted?
- Does the platform support SSO via SAML 2.0 or OAuth 2.0, and does this cover the attendee-facing app as well as the management back end?
- Is a GDPR-compliant data processing agreement available, covering all Article 28 requirements?
- Does the vendor provide a full sub-processor list and commit to notifying you before adding or changing sub-processors?
- What is the vendor’s contractual commitment for breach notification, and does it meet the 72-hour GDPR requirement?
- How frequently is independent penetration testing conducted, and are summary findings available to customers?
- What is the process and timeline for secure data deletion at the end of the contract?
- Does the vendor carry cyber liability insurance, and what is the minimum coverage level?
- Does the vendor disclose which AI sub-processors it uses, and are they listed in the data processing agreement?
- Is attendee data used to train or improve the vendor’s AI models beyond the scope of your event?
Talk to the team
Frequently Asked Questions
A mobile event app is a mobile or web-based application that supports event attendees with agendas, engagement tools, content, notifications and interaction.
The best event app depends on your goals. For engagement-led events, specialist mobile event apps often outperform all-in-one platforms.
Attendees use event apps that are intuitive, interactive and relevant to their experience. Are event apps dead? Definitely not. Read or watch our 2025 Event Advice on event apps.
Yes, modern event platforms support in-person, hybrid and virtual attendees through mobile and web-based access.
Related Articles:
Event attendance tracking has rapidly evolved from a simple headcount to one of the most
