Skip to navigation

Data & Security

What ticketing systems record about customers and sales, and how that data is reported, protected and governed.

Ticketing systems hold records of customers, orders, payments, attendance and staff activity. This subject explains what those records contain, who can use them, how they become reports, and how they are protected. Ownership and control of the data are set by contracts and data protection law as well as by the software, so the technical and the legal answers need to be read together.

Start here

What customer data does ticketing software collect?

What buyer, attendee, order, payment and attendance data ticketing systems collect, and how access, reporting, privacy and consent differ.

Who owns customer data in ticketing?

Understand customer-data ownership in ticketing, including controller and processor roles, contracts, access, privacy rights and portability.

What reporting should a ticketing platform provide?

Explore the operational, financial, customer and attendance reports a ticketing platform should provide, with guidance on reliable metrics and data exports.

What security standards should enterprise ticketing platforms meet?

Learn how PCI DSS, ISO 27001, SOC 2, privacy duties and operational controls apply to enterprise ticketing platforms, and what evidence buyers should request.

Key ideas in this subject

Collecting, owning and using data are different

Who can access, export and market to customer records depends on agreements and the law, not on whose logo is on the checkout.

Reports are only as reliable as their definitions

Sales, holds, complimentary tickets, refunds and attendance can be counted differently. Useful reports define each figure and reconcile with finance.

Security is several controls, not one standard

Card rules, encryption, access control, credential handling and monitoring each address a different risk. Check claims against current evidence.

Permissions should match roles

Staff, promoters, partners and integrations need different access. Least-privilege permissions limit what each can see and change.

The explanations in this subject are general. Specific privacy, security or compliance obligations need review by a qualified specialist for the organisation and market involved.

Reading paths

All 17 explanations in Data & Security, in 4 reading paths.

1 · Customer data and ownership
2 · Reporting, finance and attribution
3 · Security, privacy and compliance
4 · Identity and permissions

How this subject connects to others

Platforms & Infrastructure

Data control is a central question in white-label arrangements.

APIs & Integrations

Integrations move customer and order data between systems.