Security

Account Security

Passwords are never stored in plain text — they're hashed using Django's built-in password hashing framework. Sessions are tied to secure, signed cookies, and we never email or display your password back to you.

Reviewer Invites

Reviewer access to a CFP is granted through a unique, single-use invite link tied to the invitee's email address. Invite links carry no implicit access to anything else in the organiser's account, and reviewers only ever see submissions for the CFP they were invited to.

Submission Visibility Controls

Organisers choose, per CFP, who can see a submission's review feedback — reviewers only, all reviewers, the submitter, or fully open. The platform enforces these boundaries at the data layer, not just in the interface.

Data in Transit

All traffic to Happalo is encrypted using HTTPS/TLS. Form submissions, including login and registration, are protected with CSRF tokens to prevent cross-site request forgery.

Access Controls

Event editing, CFP management, and reviewer invitations are restricted to the event's organiser. Plan-based limits (events, CFPs, reviewers) are enforced server-side, not just hidden in the UI.

Responsible Disclosure

If you believe you've found a security vulnerability in Happalo, please report it to [email protected] with enough detail to reproduce the issue. We ask that you give us a reasonable amount of time to investigate and address the issue before disclosing it publicly, and that you avoid accessing or modifying data that isn't yours while testing.

Your Part in Keeping Your Account Safe

• Use a unique, strong password for your Happalo account.
• Don't share reviewer invite links — they're meant for the named invitee only.
• Contact us immediately at [email protected] if you notice any suspicious activity on your account.