1. Accessibility
European Accessibility Act (Lag 2023:254): As of June 28, 2025, digital services in the EU must meet accessibility requirements. This statement documents our compliance.
1.1 Standard
Stageboxx targets WCAG 2.1 Level AA conformance across all public and authenticated pages. This is the standard referenced by the European Accessibility Act (EAA) and Swedish implementation (Lag 2023:254).
1.2 Measures
- Semantic HTML — proper heading hierarchy, landmark elements (
<main>,<nav>,<footer>), ARIA labels - Keyboard navigation — all interactive elements reachable and operable via keyboard
- Focus management — visible focus indicators on all interactive elements
- Color contrast — minimum 4.5:1 for normal text, 3:1 for large text (WCAG 1.4.3)
- Touch targets — minimum 44×44px for interactive elements (WCAG 2.5.8)
- Screen reader support — ARIA attributes for dynamic content and state changes
- Automated enforcement — frontend architecture tests block
v-htmlwithout sanitizer, require ARIA labels
1.3 Feedback
If you encounter an accessibility barrier, please contact us at privacy@stageboxx.com. We respond within 14 days and will work to resolve the issue.
2. GDPR & Data Protection
Stageboxx complies with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Swedish law (Lag 2018:218). Our full Privacy Policy details how we handle personal data.
2.1 Consent Management
| Control | Implementation |
|---|---|
| Double opt-in | All marketing subscriptions require email confirmation |
| Per-list consent | Consent is scoped to each mailing list — subscribing to list A does not cover list B |
| Cryptographic consent tokens | 256-bit random tokens, single-use, non-replayable |
| RFC 8058 one-click unsubscribe | List-Unsubscribe-Post headers in all marketing emails |
| Complaint auto-revocation | Spam complaints immediately revoke consent |
| Immutable consent audit trail | Every consent change logged with timestamp — never deleted (Art. 7(1) proof) |
2.2 Data Retention
| Data Type | Retention | Mechanism |
|---|---|---|
| Email content (campaigns) | 30 days | Automated stripping |
| Email delivery metadata | 730 days (2 years) | Automated deletion |
| Application logs | 30 days | Automated cleanup |
| Inactive accounts | 36 months without activity | Automated anonymization |
| Order records | 7 years | Bokföringslagen requirement |
| Consent history | Indefinite | Art. 7(1) burden of proof |
2.3 Breach Notification
In the event of a personal data breach, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours as required by GDPR Art. 33. Affected individuals are notified without undue delay if the breach poses a high risk to their rights (Art. 34). Our incident response plan classifies breaches by severity (P1–P4) with defined escalation procedures.
2.4 In Progress
Architecture designed for GDPR data portability (Art. 20) and automated erasure (Art. 17) — implementation in progress.
3. Security Standards
3.1 ISO 27001 Alignment
We assess our platform against ISO/IEC 27001:2022 Annex A controls. Our internal assessment scores 85–90% alignment across authentication, authorization, data protection, input validation, logging, API security, and operational security.
Note: We are not ISO 27001 certified. This score represents our self-assessment against the standard. We pursue alignment as a framework for continuous improvement.
3.2 ISO 27034 Application Security
We maintain 46 Application Security Controls (ASCs) mapped to specific threat actors and risk scenarios, following the ISO 27034 ASC framework. Each control has a defined verification activity — many are enforced automatically via architecture tests.
| Category | Controls |
|---|---|
| Transport & protocol security | HSTS (1-year max-age + CDN Edge Rule), Content Security Policy |
| Input validation | Backend HTML sanitization, frontend DOMPurify, parameterized queries, file upload magic byte validation |
| Authentication & session | CSRF double-submit cookies, secure session cookies (HttpOnly, Secure, SameSite) |
| Authorization | 70+ granular CRUD permissions, vendor isolation (IDOR prevention), temporal entitlements |
| Rate limiting & threat intelligence | IP reputation scoring (AbuseIPDB integration), configurable rate limits |
| Automated enforcement | 43 architecture tests + 3 CI stop hooks enforce security patterns at build time |
4. Swedish Regulations
| Regulation | Requirement | How We Comply |
|---|---|---|
| Bokföringslagen 1999:1078 | 7-year retention of accounting records | All order and transaction data retained for 7 years. SIE4 export available for integration with accounting systems. |
| Kulturmoms Mervärdesskattelagen 7 kap. 1 § | 6% reduced VAT for cultural events | Platform supports configurable VAT rates per product category. Cultural event tickets default to 6%. |
| Kassaregisterlag 2007:592 | Certified cash register for physical sales | Venue responsibility. Stageboxx supports BYOL (Bring Your Own Ledger) integration with certified terminals (e.g., iZettle). |
| Ångerrätt Distansavtalslagen 2005:59 | Right of withdrawal exemption for event tickets | Event tickets are exempt from the right of withdrawal per EU Consumer Rights Directive Art. 16(l) (services for leisure activities on a specific date). This exemption is communicated during checkout. |
5. Sub-Processors
We share personal data only with the following sub-processors, each bound by a Data Processing Agreement (Art. 28 GDPR). All data is processed within the EU/EEA.
| Processor | Data Shared | Purpose | Processing Region |
|---|---|---|---|
| Brevo | Email, Name, Phone | Email delivery & marketing | EU (France) |
| Stripe | Card token (no card numbers stored) | Payment processing | EU |
| Swish | Phone number, Amount | Mobile payment | Sweden |
| BunnyCDN | IP addresses (CDN logs) | Content delivery | EU |
| GleSYS | All platform data | Infrastructure hosting | Sweden |
| 46elks | Phone number, SMS content | SMS delivery | Sweden |
| Mailjet | Inbound email (sender, content) | Inbound email parsing | EU (France) |
We never sell personal data to third parties. For details on each processor, see our Privacy Policy.
6. Encryption
| Layer | Method | Details |
|---|---|---|
| In transit | TLS + HSTS | HTTPS enforced site-wide. HSTS with 1-year max-age prevents protocol downgrade. BunnyCDN Edge Rule as backup enforcement. |
| Passwords | SHA-512 + salt | Each user has a unique random salt. Passwords are never stored in plain text. |
| Payment data | Not stored | Credit card numbers never touch our servers. Payment is handled by PCI-compliant processors (Stripe, Swish). |
7. Audit Logging
Stageboxx maintains comprehensive audit logging across multiple domains:
- Consent audit trail — every consent grant, revocation, and modification is logged with timestamp, IP address, and action type. This log is immutable and never deleted (GDPR Art. 7(1) proof of consent).
- Delivery events — email delivery, opens, bounces, and complaints are tracked per message for deliverability management.
- Application activity — user actions logged with automatic context capture (user, IP, URL, vendor scope).
- Vendor-scoped logging — each vendor’s audit trail is isolated. Vendors cannot see other vendors’ activity.
- PII masking — email addresses in application logs are automatically masked (e.g.,
p***@example.com). - Automated retention — application logs are automatically deleted after 30 days.
8. Contact
For questions about data protection, security, accessibility, or regulatory compliance:
Stageboxx AB
Email: privacy@stageboxx.com
Web: www.stageboxx.com
Supervisory authority: Swedish Authority for Privacy Protection (IMY)
Email: imy@imy.se