We use Sectigo RSA Extended Validation Certificates (4096 bit) with TLS v1.2 and v1.3 and 128 bit AES encryption or higher. Lower encryption is not supported.
Please see:
https://www.ssllabs.com/ssltest/analyze.html?d=conftool.netAll servers run on a current Linux server version. We check daily for security updates and install them the same day. Access to the servers is only possible via secure transfer. We use two-factor authentication whenever possible.
We do monthly PCI scans by Sectigo (HackerGuardian PCI Compliance Scanning 2.0)
https://sectigo.com/resource-library/hackerguardian-2-0 (a corresponding report will be sent to you upon request). All servers are secured with firewalls and run only versions of the installed services that are considered as secure.
If you are using an online payment gateway for credit card payments, we also meet the PCI DSS security requirements (as service provider SAQ D for PCI DSS V3.2.1) related to that gateway.
However, we are
not generally PCI DSS certified as payment processor. We do not store or process credit card data.
Please note that conference organizers also might require a PCI compliance test, as they have access to all data stored in their ConfTool installation.
Topic: Security level of ConfTool Servers
