About

Who 1Venda is, where the group is going and the operator that proved the platform.

Products

Six product lines on one engine, offered to your ecosystem under your brand.

Features

The back office, the apps, the platform and the protection behind every brand on it.

Industries

Whoever your ecosystem is made of, there is a gate, a till or a counter where your brand belongs.

security

Zero security incidents since launch

Your ecosystem’s money and data run through this platform, so it was built the way a bank builds: the public never touches an application server, every layer is written in a language chosen for the job, and every ticket, wallet and coupon is signed so it can only ever be used once.

the record

0 breaches. 0 DDoS outages. P40M+ sold.

Since Tickito restarted on the platform in 2023 it has sold more than P40 million of tickets, run the World Athletics Relays and more than 150 events, and has not had a single security incident. Not a leaked list, not a duplicated ticket, not an hour lost to an attack.

security incidents

successful DDoS attacks

100%

of payments on PCI-compliant gateways

how it is built

Two languages, each where it is strongest

The platform is not one application. It is a ticketing core and a web layer, written in different languages, talking to each other over private connections.

Python and Django: the core

The ticketing, cashless and coupon engine is a Django API. It issues tickets, signs QR codes, moves wallet balances and writes the ledger. It answers routine calls in milliseconds and it has no public address at all.

.NET: the web layer

The public front end, the six portals and the operations back office run on .NET. .NET gives them a compiled, type-checked, hardened surface and the speed to serve a gate at doors-open. It is the only thing the internet talks to, and it talks to the core on your behalf.

Reverse proxy and SSL

Every connection terminates at a reverse proxy over SSL before it reaches either layer. Attackers never learn where the application servers are, and nothing moves between layers unencrypted.

Docker and backups

Every part runs in its own Docker container, so nothing malicious can be embedded in a running application and a compromised piece cannot reach the others. Encrypted backups run every day and are tested.

what protects your ecosystem

Protection at every layer

No public application server

The Django core sits behind the .NET layer and a reverse proxy. The public never reaches it, so it cannot be probed, fuzzed or flooded.

DDoS protection

Traffic is filtered in front of the proxy and the platform is built for very high loads and concurrent connections, so a sold-out release does not look like an attack and an attack does not look like a release.

Signed one-time QR codes

Every ticket, wallet and coupon QR is cryptographically signed when it is issued and dies on first scan. A screenshot, a forward or a photocopy buys nothing.

Payments never touch us

Card and mobile-money details are entered on the gateway's own pages. The platform stores a payment reference, never a card number.

Roles and permissions

Team positions carry per-area permissions, from gate crew to finance manager, and every role sees only its own events, money and data. Sign-in is by phone number and one-time code.

Audit trail

Who issued, who scanned, where and when, on which device. Nothing is deleted, so a dispute is settled from the ledger, not from memory.

coupons and wallets

Cryptography that fits on a till

Coupons are the hardest case: they are money, they are handed to people with basic phones, and they are redeemed at tills the platform does not own. So each coupon carries a signed QR code bound to a person, a value, a product set and a window. The till or the vendor’s phone verifies the signature live, marks it used, and the redemption appears on the programme owner’s map within seconds. Wallet taps work the same way, which is why a wristband can be the wallet.

Service levels

Service level

Commitment

Monthly availability

99.5%

Critical incident response

Answered within 1 hour, on event nights too

Backups

Encrypted, daily, restore-tested

Hosting, upgrades, firewall and DDoS protection

Included and run by 1Venda

Payment card data

Never stored on the platform

Security incidents since launch

the stack

Built on proven engineering

.NET Core for the front end, portals and operations. Django on Python for the ticketing, cashless and coupon core. Next.js for the organiser and manager consoles. Java for the Android scanner and Swift for iOS. Docker, SSL, a reverse proxy and DDoS protection around all of it.

Asked often

Where is the data hosted?

On servers 1Venda operates for the partnership, in Docker containers behind a reverse proxy, with encrypted daily backups. Data belongs to the partnership and is exportable in standard formats.

Can our security team review the platform?

Yes. We walk partners’ technical teams through the architecture, the hosting and the incident process, and we support penetration tests arranged by the partner.

What happens in an incident?

Critical incidents are answered within an hour, around the clock on event nights. The partner is informed, the affected part is isolated by container, and a written report follows.

Why two languages?

Because they are good at different things. Python and Django make a fast, well-tested core for money and ledgers; .NET makes a compiled, hardened web layer that is quick to serve and hard to attack. Keeping them apart also means the public-facing code never holds the keys.

built like a bank

Security you can put your name on

Ask for the architecture walkthrough. We will show your technical team every layer.