Trust
How we care for your data
The materials you hand Evonli — speaker bios, sponsor logos, attendee rosters, the brochure your board has been editing for weeks — represent months of work by real people. This page is a plain-language summary of how we protect them. Our Privacy Policy is the legal version; this one is the human version.
Built for reliability
Evonli runs on Digital Ocean's managed infrastructure. The database is a managed PostgreSQL cluster with automatic daily backups and point-in-time recovery. Uploaded files — PDFs, headshots, sponsor logos, generated brochure PDFs — live in Digital Ocean Spaces, an S3-compatible object store with built-in redundancy across multiple machines.
The web and background-job tiers run on separate droplets, so a hot patch to one won't bring down the other. Backups are independent of the live system; even a catastrophic failure on the primary database doesn't take your data with it.
Encrypted in transit and at rest
Every connection to Evonli is HTTPS-only — your browser to our servers, our servers to the database, our servers to file storage. Files in Spaces are encrypted at rest by Digital Ocean. The database is encrypted at rest by Digital Ocean. Passwords are hashed (bcrypt) and never stored in readable form, by us or anyone else.
Scoped to your organization
Your event materials are scoped to your Organization at the database level. Other Evonli customers can't see your speakers, your sponsors, your attendee list, or anything else you've uploaded. Membership in your Organization is how access is granted — not a shared bucket, not a public URL.
Published brochures are different by design: they're meant for the public, and live at their own URL. But the editor side — drafts, reviews, AI extractions, attendee data, engagement metrics — is tenant-scoped and stays inside your Organization.
How AI fits in
Iris and Mae run on OpenAI's API. When you upload a document for extraction or chat with Iris in the editor, the content of that request is sent to OpenAI to do the work. OpenAI's API terms apply, and under those terms they don't train their public models on API data. We rely on that contract, and you inherit it.
AI never writes directly to your canonical records. Iris produces proposals into a staging table; nothing reaches your published brochure until a human approves it. We keep a back-pointer from every published record to the AI extraction that produced it, so you can always trace where a fact came from.
Your data, your control
Your data belongs to you. We don't sell event data, attendee data, or anything else you've trusted us with — not to advertisers, not to data brokers, not to anyone. We use it to run the Service and improve Evonli (in aggregate, de-identified form when we're looking at product metrics), and that's all.
You can export your event content, delete your account, or ask us to remove specific records at any time. Email hello@redbarnsoftware.com or use the contact form.
Simple and proven, on purpose
We keep the stack deliberately boring. Rails, PostgreSQL, Solid Queue, Active Storage on Spaces — all mature, well-documented pieces. Boring software is reliable software: it breaks in predictable ways, it recovers fast, and there's a community to lean on when something surprises us. We'd rather move quickly on the parts of Evonli that are actually novel (Iris, Mae, the ingestion pipeline) and stay conservative on the parts that keep your data safe.
If something goes wrong
No system is perfectly secure, and we won't pretend otherwise. If you suspect unauthorized access to your account, or notice anything that looks like a security issue, contact us immediately at hello@redbarnsoftware.com. We take security reports seriously and will respond promptly.
The short version: your event's story should be safe, steady, and there when you need it. That's the bar we hold ourselves to.