> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://learn.nuwebgroup.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://learn.nuwebgroup.com/_mcp/server.

# Data & Security

> Learn what customer data ticketing systems collect, who owns and controls it, what reporting to expect, and the security, privacy and permission controls that protect it.

**Ticketing systems hold records of customers, orders, payments, attendance and staff activity. This subject explains what those records contain, who can use them, how they become reports, and how they are protected.** Ownership and control of the data are set by contracts and data protection law as well as by the software, so the technical and the legal answers need to be read together.

## Start here

#### [What customer data does ticketing software collect?](/data-security/what-customer-data-does-ticketing-software-collect)

What buyer, attendee, order, payment and attendance data ticketing systems collect, and how access, reporting, privacy and consent differ.

#### [Who owns customer data in ticketing?](/data-security/who-owns-customer-data-in-ticketing)

Understand customer-data ownership in ticketing, including controller and processor roles, contracts, access, privacy rights and portability.

#### [What reporting should a ticketing platform provide?](/data-security/what-reporting-should-a-ticketing-platform-provide)

Explore the operational, financial, customer and attendance reports a ticketing platform should provide, with guidance on reliable metrics and data exports.

#### [What security standards should enterprise ticketing platforms meet?](/data-security/what-security-standards-should-enterprise-ticketing-platforms-meet)

Learn how PCI DSS, ISO 27001, SOC 2, privacy duties and operational controls apply to enterprise ticketing platforms, and what evidence buyers should request.

## Key ideas in this subject

#### Collecting, owning and using data are different

Who can access, export and market to customer records depends on agreements and the law, not on whose logo is on the checkout.

#### Reports are only as reliable as their definitions

Sales, holds, complimentary tickets, refunds and attendance can be counted differently. Useful reports define each figure and reconcile with finance.

#### Security is several controls, not one standard

Card rules, encryption, access control, credential handling and monitoring each address a different risk. Check claims against current evidence.

#### Permissions should match roles

Staff, promoters, partners and integrations need different access. Least-privilege permissions limit what each can see and change.

> **Note**
>
> The explanations in this subject are general. Specific privacy, security or compliance obligations need review by a qualified specialist for the organisation and market involved.

## Reading paths

All 17 explanations in Data & Security, in 4 reading paths.

#### 1 · Customer data and ownership

* [What customer data does ticketing software collect?](/data-security/what-customer-data-does-ticketing-software-collect)
* [Who owns customer data in ticketing?](/data-security/who-owns-customer-data-in-ticketing)
* [Who controls customer data in a white-label ticketing arrangement?](/data-security/who-controls-customer-data-in-a-white-label-ticketing-arrangement)
* [How do multi-venue groups create a unified customer view?](/data-security/how-do-multi-venue-groups-create-a-unified-customer-view)
* [How do ticketing customer groups support segmentation and presales?](/data-security/how-do-ticketing-customer-groups-support-segmentation-and-presales)

#### 2 · Reporting, finance and attribution

* [What reporting should a ticketing platform provide?](/data-security/what-reporting-should-a-ticketing-platform-provide)
* [How do you automate ticketing reports and data exports?](/data-security/how-do-you-automate-ticketing-reports-and-data-exports)
* [What should an event audit report include?](/data-security/what-should-an-event-audit-report-include)
* [How do finance teams reconcile ticketing transactions?](/data-security/how-do-finance-teams-reconcile-ticketing-transactions)
* [How do you measure ticketing marketing attribution and return on ad spend?](/data-security/how-do-you-measure-ticketing-marketing-attribution-and-return-on-ad-spend)

#### 3 · Security, privacy and compliance

* [What security standards should enterprise ticketing platforms meet?](/data-security/what-security-standards-should-enterprise-ticketing-platforms-meet)
* [How do ticketing platforms protect customer data?](/data-security/how-do-ticketing-platforms-protect-customer-data)
* [What does PCI DSS mean for ticketing businesses?](/data-security/what-does-pci-dss-mean-for-ticketing-businesses)
* [How should ticketing APIs and credentials be secured?](/data-security/how-should-ticketing-apis-and-credentials-be-secured)
* [When should ticket buyers be asked to verify their identity?](/data-security/when-should-ticket-buyers-be-asked-to-verify-their-identity)

#### 4 · Identity and permissions

* [What is single sign-on in ticketing?](/data-security/what-is-single-sign-on-in-ticketing)
* [How do ticketing permissions work across multiple venues and brands?](/data-security/how-do-ticketing-permissions-work-across-multiple-venues-and-brands)

## How this subject connects to others

#### [Platforms & Infrastructure](/platforms-infrastructure)

Data control is a central question in white-label arrangements.

#### [APIs & Integrations](/apis-integrations)

Integrations move customer and order data between systems.