How we keep the VenueSumo community secure
Last revised: May 2026
This Security Measures Supplement describes the technical and organisational measures VenueSumo Pty Ltd (VenueSumo) implements to protect the confidentiality, integrity and availability of customer data Processed through the VenueSumo platform. It supplements, and forms part of the “Security Measures” referenced in clause 4.1 of the VenueSumo Data Processing Agreement and clause 6 (Security and integrity) of the VenueSumo Terms and Conditions of Use, available at https://venuesumo.com/terms-conditions/.
VenueSumo runs on Microsoft Azure. Wherever the underlying control is delivered by Azure, we reference Azure’s own attestations rather than restate them; where the control is implemented by VenueSumo on top of Azure, we describe what we do.
Built on Azure
Enterprise infrastructure, certified to global standards
The VenueSumo platform is hosted on Microsoft Azure, which holds a portfolio of independently-audited certifications and attestations. Customers benefit from the security controls Microsoft maintains across its physical data centres, network infrastructure and platform services.
Azure compliance attestations we rely on include:
- ISO/IEC 27001, ISO/IEC 27017 (cloud-specific controls) and ISO/IEC 27018 (cloud privacy)
- SOC 1, SOC 2 and SOC 3 reports
- CSA STAR
- PCI DSS
- FedRAMP (US Federal)
- IRAP assessment at the Australian Government PROTECTED level
The current list of Azure certifications is maintained by Microsoft at https://learn.microsoft.com/azure/compliance/.
Hosting & Data Residency
Regional hosting, geo-redundant within region
VenueSumo hosts customer data on Microsoft Azure infrastructure in Australia and the United States. The region used for a given customer is determined by the contracting VenueSumo Entity:
- Australian and Asia-Pacific customers: primary region Azure Australia East (Sydney), with geo-redundant backup replication to a second Australian Azure region.
- United Kingdom and United States customers: Azure US regions, with geo-redundant backup replication within the United States.
Customer data is not transferred to regions outside the two listed above. International transfers (including UK-to-US transfers under the UK International Data Transfer Agreement) are addressed in clause 4 of the DPA.
Encryption
Bank-grade encryption, end to end
At rest
All customer data is encrypted at rest using AES-256, managed through Azure’s encryption services. Database encryption, storage encryption and backup encryption are enabled by default. Encryption keys are managed in Azure Key Vault under strict access controls.
In transit
All data in transit is encrypted using TLS 1.3 (with TLS 1.2 as the minimum acceptable version). This applies to communications between clients and servers, API calls, inter-service communications and data replication. Certificates are maintained and renewed automatically.
Payments
Card payments are processed through VenueSumo Embedded Payments, powered by Adyen, which holds PCI DSS Level 1 certification — the highest level of PCI compliance. Cardholder data is tokenised by Adyen and does not pass through or get stored on VenueSumo servers. Other third-party payment processors referenced in clause 4 of the Terms maintain their own PCI compliance.
Access Control
Least privilege, multi-factor, fully audited
Multi-factor authentication
Multi-factor authentication (MFA) is mandatory for all VenueSumo personnel accessing production systems, code repositories, databases and backup environments. MFA is enforced through Azure Active Directory across all administrative functions, with no exceptions permitted for privileged access.
Role-based access and least privilege
Access to customer data is granted on a least-privilege, need-to-know basis using role-based access control (RBAC). Administrator privileges are limited to authorised personnel. Permissions are reviewed at project kick-off, during major milestones and upon role changes or departures.
Audit logging
Comprehensive audit trails are maintained across the platform: user logins, failed access attempts, data access, administrative changes, code commits, deployments and API calls. Logs are immutable, protected from tampering, and retained for six months.
Tenant Separation
Private, partitioned data
VenueSumo operates a multi-tenant SaaS platform with logical data separation: each customer operates within their own isolated database environment, segregated at the application and database layer. Enterprise customers can additionally be provisioned on dedicated server infrastructure within Azure, providing isolated compute and database resources separate from other customers, combining the isolation benefits of a dedicated environment with the scalability of cloud infrastructure.
Application Security
Secure by design, secure in production
Secure development
VenueSumo follows OWASP secure coding standards and the OWASP Top 10 as foundational guidance. Developers receive ongoing training in secure coding practices including input validation, output encoding, secure session management and protection against injection attacks. All code changes undergo mandatory peer review with a security focus before merging.
Continuous testing
The CI/CD pipeline includes automated static and dynamic application security testing (SAST and DAST) on code changes, automated vulnerability scanning, and regression testing. Changes are tested in staging environments before production deployment, all deployments are logged, and all deployments are reversible.
Runtime protection
Production traffic passes through Azure Web Application Gateway with intrusion detection and traffic filtering enabled. Malware protection is provided by Microsoft Defender across endpoints and servers, with regularly-updated definitions and real-time threat intelligence.
Monitoring & Incident Response
Watching the platform, responding fast
Visibility
VenueSumo maintains continuous visibility across the technology stack using Azure-native monitoring tools and our internal alerting platform. Monitoring covers application performance, infrastructure health, security events, access patterns and system availability. Automated alerts notify the responsible team of anomalies and suspicious activity in real time.
Incident management
A documented security incident response plan covers detection, containment, eradication, recovery and post-incident review. The plan includes predefined roles, internal and external communication protocols, forensic preservation steps and integration with Azure’s incident tools. Incidents are logged, triaged by severity, and assigned to the appropriate response team.
Customer notification
Customers are notified of security incidents and notifiable data breaches that affect or may affect their data, in accordance with the timing and notice provisions of the VenueSumo Data Processing Agreement and applicable law (including the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and the UK GDPR breach-notification regime).
Resilience
Backed up, replicated, recoverable
VenueSumo maintains a disaster-recovery framework built around Azure’s native capabilities: automated backups and geo-redundant data replication across Azure regions within the customer’s hosting region. Disaster recovery procedures are tested periodically to validate data integrity and restoration capability. The platform is architected for high-concurrency, high-availability operation and supports automatic and dedicated scaling to manage demand changes, including peak periods such as holiday visitation surges.
Our People
Vetted, trained, contractually committed
- Background checks: background and police checks are conducted for all staff with access to production systems, customer data or sensitive infrastructure, prior to granting system access.
- Training: ongoing security-awareness training for all staff, with additional secure-coding training (OWASP-aligned) for developers.
Subprocessors & Supply Chain
Carefully chosen, continuously assessed
VenueSumo selects subprocessors and third-party providers on the basis of their security posture, certifications and compliance frameworks. Each undergoes a formal security assessment before engagement, including review of compliance certifications (e.g. PCI DSS, ISO/IEC 27001) and data-handling practices, and ongoing third-party integrations are reviewed periodically.
Microsoft Corporation is VenueSumo’s principal infrastructure subprocessor, providing the Azure hosting platform in Australia and the United States.
Your Part
A shared responsibility
Security on a SaaS platform is shared. VenueSumo provides the controls described in this document; customers play their part by:
- using the VenueSumo Services appropriately for the sensitivity of their data;
- securing the credentials, systems and devices used to access the VenueSumo platform;
- complying with the data-handling representations made in clauses 10 (Privacy) and 11 (Your Data) of the Terms, including not loading prohibited categories of data (see clause 6.2 of the DPA).
Quick Reference
At a glance
| Area | Summary |
|---|---|
| Hosting | Microsoft Azure — Australia East (primary AU region) and Azure US regions for UK/US customers |
| Infrastructure certifications (Azure) | ISO/IEC 27001, 27017, 27018; SOC 1/2/3; CSA STAR; PCI DSS; FedRAMP; IRAP PROTECTED |
| VenueSumo control alignment | ISO/IEC 27001 control alignment; NIST Cybersecurity Framework; OWASP secure coding |
| Encryption at rest | AES-256, Azure-managed; keys in Azure Key Vault |
| Encryption in transit | TLS 1.3 (TLS 1.2 minimum) |
| Payments | Adyen (PCI DSS Level 1) — cardholder data tokenised, not stored on VenueSumo systems |
| Authentication | MFA mandatory for all VenueSumo personnel access via Azure AD |
| Access control | Role-based, least privilege; inactive accounts disabled within 24 hours |
| Audit logging | Immutable |
| Vulnerability testing | SAST/DAST in CI/CD |
| Runtime protection | Azure Web Application Gateway; Microsoft Defender |
| Backups | Automated, geo-redundant within hosting region; DR procedures tested periodically |
| Tenant model | Multi-tenant with logical separation; dedicated infrastructure available for enterprise |
| People | Background-checked; NDA-bound; ongoing security training (OWASP for developers) |
| Incident notification | Per the DPA and applicable law (Privacy Act NDB scheme; UK GDPR) |
Questions
Talk to us
Customers and prospects with detailed security or due-diligence questions can reach VenueSumo at support@venuesumo.com. For matters relating to a specific engagement, contact your usual VenueSumo representative.
This document describes VenueSumo’s security posture as at the revision date shown above. VenueSumo may update the technical and organisational measures described here from time to time, provided that updates do not materially decrease the overall level of protection.
