Where your CNIC goes

Your CNIC

CNICs collected during registration are encrypted at rest. They can be decrypted only by the organising committee of the conference you registered for — not by other organisers, not by other delegates, not by anyone browsing the site. Every time one is viewed, that view is written to an audit log.

Your payment screenshot

Payment uploads are kept in restricted storage and served only through signed links that expire after five minutes, issued to the legitimate organiser. Uploads are rate-limited to five attempts per registration.

Who can see your profile

Every table enforces row-level security, so queries are filtered by the database before any data leaves it. Anonymous visitors see only explicitly public information. You can make your profile private, in which case posts, achievements and registrations are visible only to approved followers. Blocks are enforced on the server and run both ways.

Your account

Passwords are never stored in plain text, and password resets require control of the registered email. Failed logins are rate-limited — five attempts in fifteen minutes, then a thirty-minute lockout.

You can request full account deletion from settings. There is a thirty-day grace period in which you can reverse it; after that, an automated job permanently removes your personal data. Records tied to paid registrations are anonymised rather than deleted, so organisers keep a compliance trail without keeping your identity.

Administrators

Sensitive administrative actions — revealing a CNIC, approving a conference, moderating an account — are written to an immutable audit log. Attempts to call admin-only functions without the required role are logged separately for review.