IAEE Just Told Organizers to Vet Their Vendors’ Security. Here’s How We’d Answer.

IAEE Just Told Organizers to Vet Their Vendors' Security. Here's How We'd Answer.

July 16, 2026

International Association of Exhibitions and Events (IAEE) Event Technology Committee just launched its first-ever cybersecurity newsletter for the exhibitions industry – The Cyber Corner. Good on them for it – this is the kind of question the industry should have been asking years ago. The inaugural issue makes a simple but pointed argument: cybersecurity isn’t an IT afterthought anymore, it’s a core part of event planning, and organizers should be asking their technology vendors three direct questions.

How do you protect our data? Have you experienced a recent security incident? What certifications or third-party assessments do you maintain?

These are good questions. Most event platforms would rather they didn’t get asked. Here’s how ShowCycle answers them – and why the answer isn’t something we built specifically to pass a checklist.

Question 1: How do you protect our data?

By not having a separate place to protect it. ShowCycle doesn’t operate its own database of attendee, exhibitor, and payment information sitting somewhere alongside Salesforce – it runs natively inside Salesforce , using Salesforce’s own data model, records, and permission structure. That means event data inherits the same protections Salesforce applies to every enterprise customer running mission-critical operations on the platform: encryption at rest and in transit, granular field- and object-level permissions, and audit trails on who accessed what and when.

Question 2: Have you experienced a recent security incident?

We can point to the opposite: World Defense Show , one of the largest and most scrutinized B2B defense exhibitions in the world, put ShowCycle through its own rigorous security review covering 950+ exhibitors, 130,000+ visitors, and 450+ international delegations across 80,000+ square meters. ShowCycle passed without modification. Not with a patch, not with a custom carve-out – as-is. A platform that needs special-case changes to satisfy serious scrutiny is a platform that was assembled to look secure. Passing without changes is what happens when the security was never separate from the platform to begin with.

Question 3: What certifications or third-party assessments do you maintain?

This is where “Salesforce-native” stops being an architecture decision and becomes a security posture. ShowCycle is a certified Salesforce app. It has passed stringent a security review and meets best practices in software engineering. It inherits Salesforce’s entire security framework rather than maintaining a parallel one:

Multi-factor authentication is enforced at the platform level, not bolted on as an optional add-on. Password policies – minimum strength requirements, mandatory rotation, no credential sharing between users – are Salesforce’s own policies, already built to satisfy enterprise customers with far stricter compliance requirements than a typical event platform faces. IP-based access restrictions let organizations lock down exactly where login attempts can come from. None of this is something ShowCycle had to design, test, and maintain on its own – it’s already there, because it’s already Salesforce.

ShowCycle isn’t alone in making this bet. Fonteva and Thynk.Cloud , ShowCycle’s partners in payments and venue management, are built the same way – natively on Salesforce, inheriting the same security foundation rather than assembling their own. When your event technology stack is built entirely on Salesforce-native applications, there’s one security framework to trust, not three or four different vendors each answering IAEE’s questions differently.

What "tolerated" looks like elsewhere in this industry

It’s worth being blunt about what IAEE’s questions are really responding to. Across event tech, it’s still common to find login credentials that would never survive scrutiny in almost any other software category – a username that’s just a booth number or a company name, paired with a password that looks like it was generated to fit on a license plate. No rotation requirement. No restriction on sharing it across a whole exhibitor team. No meaningful policy behind it at all.

Meanwhile, the rest of the software world has already moved past where that kind of login sits. Passkeys – the passwordless standard now being recommended by national cybersecurity agencies – aren’t just an extra layer bolted onto MFA. A passkey combines something you have (a private cryptographic key bound to your device) with something you are or know (a biometric scan or device PIN), which means a single passkey login already satisfies the definition of multi-factor authentication on its own, while removing the shared, guessable, phishable secret a password represents in the first place. It’s not “MFA plus something extra.” It’s a fundamentally more secure replacement for the password-and-code combination most people still think of as MFA – one that can still be layered with additional verification for especially sensitive actions, but doesn’t need to be just to clear the multi-factor bar.

That’s the gap. Part of the industry is still handing out the equivalent of a shared locker combination. The security-conscious part of the software world has moved on to cryptographic credentials that can’t be phished, guessed, or reused. Salesforce – and by extension ShowCycle – sits firmly in the second category, not the first.

This isn’t a hypothetical worst case. It’s a pattern the industry has largely tolerated, because event software has historically been treated as a seasonal, disposable tool rather than a system that holds real financial and personal data. That tolerance is exactly what IAEE’s newsletter is starting to push back on – and exactly what a platform inheriting Salesforce’s authentication standards doesn’t have room for in the first place. There’s no “simple password” option to fall back on, because the platform was never built with one.

The part that connects back to "Never Obsolete"

Here’s the thing about security that most vendor comparisons miss: it isn’t a certificate you earn once and keep on a shelf. It’s a moving target. New vulnerabilities get discovered. Compliance standards get revised. Attack techniques evolve faster than most software vendors can patch for them.

A standalone event platform has to fight that battle alone, on its own release schedule, with its own security team – if it has one. ShowCycle doesn’t fight that battle alone. Salesforce invests continuously in platform-level security specifically because its customer base includes some of the most heavily regulated industries in the world – financial services, healthcare, government. ShowCycle’s security posture improves whenever Salesforce’s does, without a separate upgrade cycle, without a lag, without ShowCycle’s team having to rebuild anything to keep up.

That’s what “Never Obsolete” actually means in security terms: not that ShowCycle will never need to improve, but that it never has to fall behind waiting for its own turn to catch up.

What does it mean for event software to inherit Salesforce's security framework?

It means authentication policies, access controls, encryption standards, and compliance certifications aren’t built and maintained separately by the event platform – they’re the same protections Salesforce applies across its enterprise customer base, including multi-factor authentication, enforced password policies, and IP-based access restrictions, automatically extended to any application running natively on the platform.

We sleep well at night. Every night. Do you?