Security and privacy
awaiting.rsvp is built so that guest data stays between hosts and guests. Event pages are private by default, invitation links are hashed single-use capabilities, and nothing about your guests is sold or shared.
Every event page is unlisted and marked noindex for search engines unless the host explicitly turns on public listing. Personal invitation links are never indexed, never appear in sitemaps, and never appear in referrer headers.
Invitation and reminder tokens are random, expire on their own, and are stored only as SHA-256 hashes. A leaked database row cannot reconstruct a working link.
Public endpoints never reveal whether a guest or event exists beyond the link you already hold. Guessing codes does not leak names or details.
Organizer access uses JWT authentication with role-based, organization-scoped isolation. Co-hosts and check-in staff see only what their role allows, and only for the events they belong to.
API requests are rate limited, and open RSVP forms are protected by a honeypot and timing checks, with CAPTCHA verification available where abuse is detected.
RSVP submissions are idempotent: a double tap or a retry never double-counts a guest, and capacity is enforced transactionally so headcounts stay truthful.
awaiting.rsvp allows AI and search crawlers on its public marketing pages so the product can be found and cited. Private event pages and personal invitations are excluded from every index by design, no matter what: they carry noindex rules, never appear in sitemaps, and are never submitted anywhere. If a host explicitly opts in to public listing, only that event appears, and only with the details the host approved.