A company identifier on every record
Events, talks, registrations and team members all belong to a company. Look-ups have to match that company.
Product
Security and tenant isolation.
Several companies on one system, with each company’s events, people and reports kept strictly apart.
No card required. One event, 10 talks and 5 registrations during the trial.
Roles inside the company
Owner, admin, event manager, talk editor, check-in staff and report viewer. People only see what their job needs.
A separate super-admin
Doorly uses a distinct login to see every customer: plan, trial dates, usage and subscription status. That area is rate-limited, CSRF-protected, and kept off the public navigation.
Passwords are hashed. Sign-in is rate-limited. Sessions time out after 30 minutes idle, and after 12 hours in any case. Stripe fields are stored as placeholders until billing is connected. Two-step login for owners and platform staff is planned and not yet on.