Security & Trust Centre

Architecture, controls, and disclosure policy for enterprise IT teams · Last reviewed: 29 March 2026

Architecture & Data Flow

Understanding where data travels is essential for IT risk assessment. EngageLive is architecturally simple:

What is stored on EngageLive's servers (Hostinger, Lithuania EU):

• Template library metadata (no participant data)
• Purchase records (email address + package + expiry date, for plan verification)
• Blog posts and static content

What is never sold, shared, or used for advertising: poll responses, quiz answers, participant names, Q&A content, word cloud submissions, and all session content. Results are accessible only to the authenticated host who ran the session.

What is stored on our servers: Host account details (email, name, organisation), session metadata (date, participant count, activity types), aggregated response data (counts per option, averages) retained per plan schedule. Individual participant PII entered during sessions is minimised and not retained beyond session end unless exported by the host.

Security Controls

Control	Status	Details
TLS / HTTPS	✅ Enforced	TLS 1.2+ mandatory, HTTP permanently redirected. HSTS max-age 1 year with preload.
Content Security Policy	✅ Deployed	Strict CSP restricts script execution to known origins. Inline scripts permitted only for session functionality.
X-Frame-Options	✅ SAMEORIGIN	Prevents clickjacking via iframe embedding from third-party domains.
HSTS	✅ 1 year + preload	Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Referrer Policy	✅ strict-origin	Only origin (not path) sent in Referer header to third parties.
Permissions Policy	✅ Minimal	Camera, microphone, geolocation, USB, Bluetooth all disabled.
Directory Listing	✅ Disabled	Options -Indexes in .htaccess. No server directory browsing.
Config File Access	✅ Blocked	config.php blocked from web access via .htaccess FilesMatch.
SQL Injection	✅ Mitigated	All database queries use PDO prepared statements with parameterised inputs. Input sanitisation applied at API layer.
XSS Prevention	✅ Escaped	All user input is HTML-escaped via htmlspecialchars() server-side and esc() client-side before rendering.
CSRF	✅ Token-based	Payment endpoints use HMAC-signed server tokens. Admin panel uses session authentication.
Admin Panel	✅ Auth required	Admin panel requires password authentication. Session cookie is HttpOnly and Secure.
PHP Version	✅ PHP 7.4+	Hosted on Hostinger with current PHP version. display_errors disabled in production.
Payment Card Data	✅ Never stored	Card data processed directly by PayPal/PayU. EngageLive servers never receive or store card numbers.
Cookie Security	✅ Secure flags	Admin session cookie: HttpOnly=1, Secure=1, SameSite=Strict. No tracking cookies set.
Penetration Testing	⚠️ Planned	External penetration test scheduled for Q3 2026. Results will be published in this section.
SOC 2	⚠️ In progress	SOC 2 Type I audit in preparation. Expected Q4 2026. GDPR DPA available now — see DPA page.

Incident Response

In the event of a confirmed security incident affecting personal data:

1. Detection and containment: Within 1 hour of discovery, the affected system is isolated.
2. Assessment: Within 4 hours, scope and impact assessed. Personal data affected identified.
3. Customer notification: Affected Controllers (organisations with signed DPAs) notified by email within 24 hours of confirmation — before the GDPR 72-hour supervisory authority deadline.
4. Regulatory notification: Where required, we notify the relevant supervisory authority within 72 hours of becoming aware.
5. Root cause and remediation: Post-incident report published to affected parties within 14 days.

Security incidents can be reported to security@postlister.com. Response within 24 hours on business days.

Employee & Access Controls

• Server access restricted to named individuals via SSH key authentication
• Admin panel access controlled by hashed password stored in config
• No third-party employees have access to production systems without explicit authorisation
• All access to purchase records requires admin authentication

Vulnerability Disclosure Policy

Acknowledgments

We thank the following researchers for responsible disclosure (none to date — this section will be updated as the programme matures).

IT Department Checklist

Common enterprise IT questions about EngageLive:

Question	Answer
Does the app store participant responses on your servers?	Minimally. Individual responses flow through Firebase in real-time for instant display. Aggregated session results (counts per option, averages, leaderboard positions) are archived on our encrypted servers to power the host's post-session analytics. Raw individual responses are not retained beyond what's needed for the aggregation. Firebase clears real-time session data at session end.
Can we use EngageLive without exposing employee emails to the vendor?	Yes. Participants are never required to provide their email address — name and email are optional fields controlled by the host. The host's own email is stored on our servers for authentication purposes. Participant response data (answers, votes) contains no email addresses unless the host explicitly enables email collection for their session.
Does EngageLive use cookies for tracking?	No. No analytics or advertising cookies. See Cookie Policy.
Is there a signed DPA available?	Yes. Available at engagelive/dpa.html. Counter-signed within 2 business days.
Where are servers located?	Application: Hostinger Lithuania (EU). Real-time messaging: Firebase Singapore. See DPA for full sub-processor list.
Is the app accessible for users with disabilities?	WCAG 2.1 AA target. Accessibility statement at engagelive/accessibility.html.
Can we whitelist the domains needed?	Yes. Required: postlister.com, *.firebaseio.com, *.googleapis.com, fonts.gstatic.com. Optional (payments): paypal.com, secure.payu.in. Optional (ads, removable): pagead2.googlesyndication.com.
Is there an SSO / SAML integration?	Not currently. Enterprise SSO integration (Azure AD, Okta, Google Workspace) is on the roadmap. Contact support@postlister.com.
What is your uptime SLA?	EngageLive depends on Hostinger's uptime (99.9% SLA) and Firebase's uptime (99.95% SLA). Enterprise SLA agreements available on request.
Do you have SOC 2 / ISO 27001?	SOC 2 Type I audit in preparation (target Q4 2026). GDPR DPA and this security documentation are available now. Contact security@postlister.com for our security questionnaire response.

For IT department queries, vendor assessment questionnaires, or enterprise deployment support: support@postlister.com