Technology and security
Keeps running, even when everyone shows up at once.
On-sale at 10 a.m., a line at the door, no signal in the basement club: TickySmart is built for exactly these moments. On our own servers in German data centers, monitored around the clock.
- Hosted in Germany
- GDPR compliant
- Check-in works offline
- Built in Germany
01In short
Fast, secure and in Germany.
Fast during every rush
A waiting room for on-sale day, no overselling, and check-in that keeps working without internet.
Read about on-sale dayBuilt to be secure and reliable
Separate services on Kubernetes, a backup every night, and monitoring around the clock.
Read about reliabilityYour data stays in Germany
Servers, database, files, backups and source code are all at Hetzner. No US cloud provider, GDPR from day one.
Read about hosting02On-sale day
When everyone hits “Buy” at 10 a.m.
With the waiting room, buyers line up in a fair queue instead of hitting checkout all at once. You decide how many get into checkout per minute, and you can change the pace while sales are running.
- 1Get in lineStarting an hour before the on-sale. Everyone who’s there by the start gets a random spot. Showing up earlier doesn’t give you an edge.
- 2A spot in the queueBuyers see their position and can get an email when it’s their turn. Leaving the page doesn’t cost them their spot.
- 315 minutes to buyAfter that, checkout holds the tickets for 10 minutes so nobody can snatch them away during payment.
No overselling, ever
Every reservation checks inventory inside a locked database transaction. Two buyers can never get the last ticket at the same time, and on a seating plan every seat sells only once. An automated test has several buyers fight for the last ticket at once: exactly one gets it.
No double payments
If a payment provider reports the same payment twice, it’s only booked once. If a payment arrives after the reservation has expired, it’s refunded automatically instead of issuing one ticket too many.
The queue runs in Redis
The waiting room lives in extremely fast in-memory storage, not in the main database. That keeps the shop fast even when thousands line up at once.
Fast shop pages
Event pages are rendered on the server, and the data sits in a cache. Images are saved as WebP in the right sizes when you upload them, and videos only load after a click. The embeddable widget is smaller than 5 kB.
A waitlist when you sell out
If someone returns a ticket, it goes to the next person on the waitlist automatically. Sold out doesn’t mean empty seats.
Control the pace
You check “Expecting high demand,” pick the start time and how many buyers get into checkout per minute. If checkout is running smoothly, you turn up the pace while sales are live.
03Check-in
Scan fast, even when the network gives out.
The scan app loads all of the day’s tickets onto the device ahead of time. If the connection drops in the basement club, on the festival grounds or on an overloaded cell network, your team just keeps scanning. As soon as there’s signal again, the app syncs everything.
Tickets are checked right on the device. That’s why check-in keeps running even if our servers were ever unreachable.
Tickets that can’t be faked
Every QR code is cryptographically signed with Ed25519. The app recognizes real tickets even without a connection to the server. Copies and fakes stand out.
No double entry
If two entrances with a connection scan the same ticket at the same moment, TickySmart only lets it through once. If a ticket was scanned offline on two devices, the live view shows it as a double scan.
No special hardware
Any smartphone with a camera will do, since the scan app runs in the browser. Handheld scanners work too. Native apps for iOS and Android are in the works.
A clear answer from six feet away
Green for valid, yellow for a note like “Check ID,” red for invalid. Plus a distinct sound for each result, so nobody has to stare at the screen.
More than just check-in
Areas like VIP or backstage, re-entry, guest list and age checks. At the bar, the same devices redeem drink tokens and merch.
Live view in the dashboard
How many people are already in, how many are still coming, how full each area is and which devices are scanning. The numbers update every few seconds.
04Reliable
Built not to go down.
If one part gets stuck, the others keep running. That’s thanks to separate services, background queues and a cluster that restarts failed services on its own.
Heals itself
If a service fails, Kubernetes restarts it. It only gets requests again once it’s really ready.
More power during a rush
The shop and the API run as their own services. When demand goes up, more of them start up where they’re needed.
A problem stays small
More than ten services run separately. If sending emails gets stuck, the shop keeps selling, and the emails go out as soon as sending works again.
Nothing gets lost
Emails, ticket PDFs, wallet passes and webhooks run in the background and are retried several times if something goes wrong. If the order exists, so does the message to your systems.
More than 3,000 automated checks
They cover checkout, check-in, payments and the separation between organizers, around 480 of them right in the database.
Updates without downtime
Type checks and tests run before every release, and nothing goes live until it’s approved. If a database change fails, the previous version keeps running.
Watched around the clock
The systems are monitored 24/7. When there’s a problem, the system raises the alarm, not your first buyer.
Backed up every night
The database is fully backed up every night to separate storage at Hetzner. The last 30 backups are kept, and each one is verified with a checksum.
05Architecture
Built like the big platforms.
MACH stands for microservices, API-first, cloud-native and headless. Agencies and IT departments know the terms. Here’s what they mean for you.
Independent services instead of one big block.
Shop, dashboard, scan app, API, worker and PDF generation run as separate services in their own containers.
- A problem stays limited to its own area
- Each part can be scaled up and updated on its own
Everything through an open API.
Every dashboard feature is an endpoint of the TickySmart API. The dashboard uses the same API as everyone else.
- Public API with API keys and OpenAPI docs
- Webhooks for your own systems
- AI assistants like Claude or ChatGPT create events through their own MCP access
Built for Kubernetes.
Every part runs in its own containers, and the infrastructure is described as code and rolled out automatically.
- Failed services restart on their own
- More power can be added when needed
- Test and live environments are set up the same way
One core, many front ends.
The ticket shop, the widget for your website, a shop on your own domain like tickets.myclub.com and the scan app all use the same core.
- Your shop looks like your brand
- It runs where your guests are
The same architecture the big platforms rely on. For organizers of every size.
06Hosted in Germany
Your data stays in Germany.
Many ticketing platforms run on American cloud providers. TickySmart runs its own infrastructure, at Hetzner in German data centers. Hetzner is a German company with its own data centers and has been around since 1997.
07Security and privacy
Built in, not bolted on.
When the city, your club’s board or your data protection officer asks, you have answers instead of promises.
Your data
- Strictly separated. Each workspace only sees its own data. The separation sits right in the database (Row Level Security) and is tested automatically with every change.
- Encrypted connections. Everything runs over HTTPS, and certificates renew automatically, including for custom shop domains.
- Keys stored encrypted. Access to payment accounts and tracking, ticket signing keys and webhook secrets are encrypted with AES-256. We only store API keys as a hash.
- Isolated services. Every container runs with minimal permissions, without admin rights.
Your team
- Two-factor sign-in for every account, with backup codes. New accounts confirm their email address.
- Nine roles. Such as owner, admin, accounting and marketing. Team members can be limited to specific events, and the database enforces that too.
- Change log. Important changes are recorded in the audit log.
- Abuse protection. Requests to the API and sign-in are rate-limited.
Your buyers
- Money goes straight to you. Ticket revenue lands in your account with Stripe, Mollie or PayPal. Buyers enter card details directly with the payment provider, and TickySmart doesn’t store any.
- GDPR features built in. Data access and export per customer, deletion at the push of a button, retention periods and anonymization.
- Tracking only with consent. Meta, TikTok and Google only run if you set them up and the buyer agrees. Without tracking, there’s no banner.
- Data minimization. We remove metadata like GPS location from uploaded images. We don’t store birth dates for age limits, the buyer just confirms their age.
08Technology
Proven open-source technology, self-managed.
We rely on tools that run large systems around the world, and we run them ourselves. We keep the stack up to date with the latest stable versions.
Infrastructure and operations
The standard for running containers, originally developed by Google. Restarts failed services and adds capacity when needed.
Every service runs in its own isolated container, exactly the same in test and live.
The entire infrastructure is described as code and can be rebuilt exactly the same way at any time.
German hosting provider with its own data centers. This is where the servers, database, files and backups live.
Source code, automated tests and deploys live on our own GitLab.
Automatic HTTPS certificates for every address, including custom shop domains.
Data
One of the most reliable databases in the world. Transactions prevent overselling, and Row Level Security keeps organizers separate.
Open-source platform built around PostgreSQL and file storage, run by us instead of in the Supabase cloud.
Lightning-fast in-memory storage for the waiting room, queues and abuse protection.
Application
A fast, widely used runtime for our servers.
A structured framework for our API, with cleanly separated areas.
Fully typed code from the server to the app. Many bugs get caught before they go live.
The ticket shop is rendered on the server, so it loads fast, even on a phone. Self-hosted, not on Vercel.
One codebase for the iOS and Android apps.
An openly documented API developers use to connect TickySmart to their own systems.
09FAQ
Questions from IT and data protection
For everyone who checks carefully before getting started: IT, data protection officers, procurement offices and club boards.
Where is my data stored?
At Hetzner in German data centers: servers, database and files in Falkenstein, and the backups on separate storage. The source code lives on our own GitLab.
What happens when lots of people try to buy the second tickets go on sale?
With the waiting room, buyers get into checkout fairly and at the pace you set. Inventory is checked under a lock with every reservation, so overselling is ruled out.
What happens at check-in without internet?
The scan app keeps checking offline and syncs everything as soon as there’s signal again. It recognizes real tickets by the signature in the QR code, even without a connection to our servers.
How often is the data backed up?
Fully every night, to separate storage at Hetzner in Germany. The last 30 backups are kept, and each one is verified with a checksum after upload.
Who can see my customer data?
Only your team, with the permissions you give them. Other organizers have no access, and the separation sits right in the database.
Does my money go through TickySmart?
No. Payments go straight to your own account with Stripe, Mollie or PayPal.
Does TickySmart store card details?
No. Buyers enter their payment details directly with the payment provider.
Which service providers process data?
Hosting, database and storage: Hetzner in Germany. Payments: your account with Stripe, Mollie or PayPal. Email delivery: Mailgun through its EU region. The full list of subprocessors: [Placeholder: link coming].
Is there a data processing agreement?
Yes. [Placeholder: link to the DPA coming]
Can I export and delete my data?
Yes. You export orders, customers and statistics as CSV or Excel, and the data access report per customer as a file. If you delete a customer, the amounts stay on record anonymously for accounting. On request, we delete the entire workspace.
Is there an API for our systems?
Yes: a public REST API with OpenAPI documentation and API keys, plus webhooks for events like new orders or check-ins.
Ready for your next rush?
Fast when tickets go on sale, secure with your data, hosted in Germany.