Last updated: 26 September 2026
The Arabic version of this page is the binding one; this is a faithful rendering of it.
The site runs on a single virtual server hosted by DigitalOcean in its New York (NYC1) region, in the United States. The database and every uploaded file are on that server's own storage volume. No copy of the data is held by any other company, and nothing is sold, rented or shared with advertisers.
Every page is served over HTTPS with a certificate renewed automatically; plain HTTP is redirected. Outgoing email leaves through authenticated relays (ZeptoMail for automated messages, Zoho for member communications) with SPF, DKIM and DMARC published for the domain.
The database is dumped every night and the last fourteen dumps are kept on the server. Each morning a copy of the newest dumps and of all uploaded files is pulled to a separate machine, so a loss of the server does not mean a loss of the data. The server itself holds no credential to that off-site copy, which cannot be erased from the server.
Passwords are stored as bcrypt hashes and are never visible to anyone, including us. Sign-in, password reset, registration and the contact form are rate-limited. A site administrator can enter a member's account only through a logged action that records who entered, whose account, when, and from which address; a red band names the account the whole time.
Files attached to events and library items are checked by type before they are stored, and the upload folder is served with script execution disabled at the web-server level. Payment receipts uploaded by participants are kept outside the public folder and are shown only to the participant and the event's organiser.
An organiser sees the registrants, submissions and messages of their own events and nothing of anyone else's; every organiser action is checked against the event it names, not the page it came from. Reviewers see a submission's title and file, not its author. Members' email addresses are never displayed to other members.
Every list on an event downloads as a spreadsheet, and the submitted papers as one archive, from the event's own page. A member may ask for their account and its data to be removed from the contact page; an organiser may ask the same for an event they created.
There is no formal data-processing agreement template yet, no certification (ISO 27001 or similar), and no hosting region other than the United States. If your institution requires any of these, write to us before relying on the site; we would rather say so now than have you find out later.
See also the privacy policy, which says what is collected and why.
