DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Payment Card Industry (PCI)

Data Security Standard

Attestation of Compliance for Onsite
Assessments – Merchants
Version 3.2.1
Revision 2
September 2022

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Document Changes
Date
September 2022

Version
3.2.1
Revision 2

Description
Updated to reflect the inclusion of UnionPay as a Participating Payment Brand.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page iDocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Section 1: Assessment Information
Instructions for Submission
This Attestation of Compliance must be completed as a declaration of the results of the merchant’s assessmentwith the Payment Card Industry Data Security Standard Requirements and Security Assessment Procedures(PCI DSS). Complete all sections: The merchant is responsible for ensuring that each section is completed by
the relevant parties, as applicable. Contact your acquirer (merchant bank) or the payment brands for reportingand submission procedures.

Part 1. Merchant and Qualified Security Assessor Information
Part 1a. Merchant Organization Information
Company Name:

Eventbrite, Inc.

DBA (doing
business as):Not ApplicableContact Name:

Lanny Baker

Title:

Chief Financial Officer

Telephone:415-694-7900

E-mail:lanny@eventbrite.com

Business Address:

95 Third Street, 2nd Floor

City:

San FranciscoState/Province:

CA

USA

Zip:

URL:

https://www.eventbrite.com

Country:

94103

Part 1b. Qualified Security Assessor Company Information (if applicable)
Company Name:

Coalfire Systems, Inc.

Lead QSA Contact Name:

Christy Belknap

Title:

Senior Consultant

Telephone:877-224-8077

E-mail:CoalfireSubmission@coalfire.com

Business Address:

8480 E Orchard Rd., Suite
5800

City:

Greenwood

State/Province:

CO

USA

URL:

https://www.coalfire.com

Country:

Zip:

80111

Part 2. Executive Summary
Part 2a. Type of Merchant Business (check all that apply)
Retailer

Telecommunication

Grocery and Supermarkets

Petroleum

E-Commerce

Mail order/telephone order (MOTO)

Others (please specify):
What types of payment channels does yourbusiness serve?

Which payment channels are covered by thisassessment?

Mail order/telephone order (MOTO)

Mail order/telephone order (MOTO)

E-Commerce

E-Commerce

Card-present (face-to-face)

Card-present (face-to-face)Note: If your organization has a payment channel or process that is not covered by this assessment, consult
your acquirer or payment brand about validation for the other channels.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 1

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Part 2b. Description of Payment Card BusinessHow and in what capacity does your businessstore, process and/or transmit cardholder data?

The Eventbrite platform enables event organizers to selltickets and manage registrations. Event attendees canpurchase tickets for these experiences. Eventbrite
facilitates processing, transmission, and storage of
payment card payment transactions on behalf of merchantcustomers and as a service provider.
Merchant: Eventbrite acts as the merchant of record(MOR) for the payment transactions. The customer (event
organizer) does not need to have a merchant account tosell tickets. Eventbrite will settle payment transactions onbehalf of the organizer, then fund the organizer’s bankaccount with the proceeds via check or direct deposit.
Eventbrite uses payment processors Braintree,
CyberSource, Mercado Pago, Adyen, and Auth.net for
authorizing the payment card transactions. PayPal, Amex
and Stripe are also used for processing credit card
payments; however, Eventbrite does not have access toany card data when these processors are used. Eventbrite
reviews the appropriate PCI-DSS forms for all payment
processors, for conformity with their PCI-DSS
requirements.
Service Provider: Direct funding is available to event
organizers who already have their own Merchant ID andhave set up an account with payment processors,
Authorize.net. With this option, the event organizer is themerchant of record for the payment transaction andEventbrite processes the payment card transactions andthen deposits the collected funds directly into thecustomer’s merchant account. Eventbrite receives,
processes, and transmits cardholder data via the payment
methods and channels described below:
Card-not-present transactions:
Desktop / Mobile Web: An attendee begins a transaction
to purchase tickets to an event on the Eventbrite website,
either on their desktop browser or on the browser of theirsmartphone or tablet, chooses the ticket type andquantity, then are redirected to a checkout page. During
the checkout process, the attendee is prompted tomanually enter their personal information (name,address), primary account number (PAN), card expiration
date, and card validation value (CVV2, CVC2, CID). This
information is transmitted inbound via HTTPS using TLS

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 2DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74(Transport Layer Security) 1.2 with at least
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption and maximum of
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256bit encryption, supporting the most secure protocol andstrongest cipher that the attendee’s web browser cannegotiate to Eventbrite’s front end Load Balancers which
terminate the TLS connection and forward the transaction
information to Eventbrite’s API; the web front end forward
the payment information to Eventbrite’s Payment servers
via HTTPS using TLS 1.2 with AES-256-bit encryption. In
the Payments server, payment card data is encrypted with
Eventbrite 2048-bit RSA key and retained in the server inprocess memory until it is needed for transmission
outbound to Eventbrite’s Payment Gateway. The PAN,
card expiration date, and card validation values (CVV2,
CVC2, CID) are then securely transmitted outbound fromthe Payment Servers to the supported payment
processors using the following transmission protocols:

Authorize.net: TLSv1.2 with ECDHE-RSAAES256-GCM-SHA384-bit encryption.

Braintree: TLSv1.2 with ECDHE-RSA-AES128GCM-SHA256-bit encryption.



CyberSource: TLSv1.2 with ECDHE-RSAAES256-GCM-SHA384-bit encryption.

Adyen: TLSv1.2 with ECDHE-RSA-AES128GCM-SHA256-bit encryption.



Mercado Pago: TLSv1.2 with ECDHE-RSAAES128-GCM-SHA256-bit encryption.



PayU: TLSv1.2 with ECDHE-RSA-AES128-GCMSHA256-bit encryption.



Amex: TLSv1.2 with ECDHE-RSA-AES128-GCMSHA256-bit encryption.

The Payment Gateway performs additional functions
including submitting requests, error processing, logging,journaling, and tokenization of cardholder data. Post
authorization, cardholder data is released from the
Payment Server’s in-process memory and overwritten as
new transactions are processed. Eventbrite storesfirstname, lastname, expiration date, truncated PAN (lastfour digits of the PAN or first six and last four digits of thePAN) and reference token cardholder data in the MySQL
5.7 AWS Aurora databases (EBProd and ProdPayments).
iOS and Android Native Attendee Application: Eventbrite
provides mobile applications for use by event attendees tofind events and purchase tickets to these events. The
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 3DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

applications are built by Eventbrite and are available fordownload on the iTunes App Store and Google Play App
Store. The attendees enter their name, address, PAN,
card expiration date, and card verification values (CVV2,
CVC2, CID) similar to the Eventbrite ecommerce Website.
The iOS/Android application will first perform RSA 2048bit asymmetric encryption of the data in-app using a public
key published by the Eventbrite API. The encrypted datais then transmitted to Eventbrite front end CloudFront
Load Balancer servers via HTTPS using TLS 1.2 with atleast minimum of
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption and maximum of
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256bit encryption or higher supporting the most secure
protocol and highest cipher that the attendee’s web
browser can negotiate; Eventbrite uses AWS native
CloudFront Content Deliver Network (CDN), Web
Application Firewall (WAF), and Application Load
Balancer (ALB), collectively called AWS Shield, the TLS
termination from the customers happens at the
CloudFront layer, which is very close to the customers.
The terminal TLS connection happens between
CloudFront and ALB. This is finally forwarded to
Eventbrite’s API. The transaction data is then transmitted
to Eventbrite API servers. Once the API servers receive
the encrypted data, it is decrypted to cleartext using the2048-bit RSA private key. This payment card data isforwarded from the API servers to the Payments servers
for payment processing. The PAN, card expiration date,and card validation values (CVV2, CVC2, CID) are thensecurely transmitted outbound from the Payment Servers
to the supported payment processors. Payment
processing from the Payments server is handled in exactly
the same way as detailed above for the Eventbrite
Website.
Tokenized Wallets: In Q2 2022 Payments added thecapability for attendees to purchase tickets using mobile
payment wallets: ApplePay & GooglePay. Both of thesemobile payment systems were integrated through ourexisting processing rails with Braintree. There is an SDK
utilized within the Checkout application that allows us topresent the payment method, so long as the SDK calldeems the method is available (i.e. the Apple device
supports ApplePay). All processing data and card
information is managed between Apple/Google &Braintree as the verification is either done using consumer
biometrics or PIN validation (Google).
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 4

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

iOS and Android Organizer Mobile Application: Eventbrite
provides mobile applications that allow event organizers toaccept card-present payments when selling tickets “at thedoor”. The mobile applications are developed internally by
Eventbrite and available at the Apple / Android stores.
Apple iOS/Android applications are developed for use by
event organizers and venue managers. These
applications support both manual card entry and magnetic
stripe (Track 1/Track 2) data. The following describes the
manual card entry payment processing flow: The event
organizers manually key-in the cardholder’s PAN, card
expiration date, card verification value (CVV2, CVC2, CID)
and Zipcode into the Eventbrite iOS/Android application.
Manually entered card data is immediately encrypted at
the point of capture by the Eventbrite iOS/Android
application using RSA asymmetric (public/private key)encryption with an Eventbrite 2048-bit RSA public key andsecurely transmitted inbound over the Internet to
Eventbrite CloudFront load balancers/API servers via TLS
1.2 with minimum
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption and maximum of
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256bit encryption, supporting the most secure protocol andhighest cipher that the event organizer’s mobile
application can negotiate. The API servers via theembedded order service API passes encrypted key blob
to Amazon KMS. Once KMS decrypts the data-encrypting
key, the card data is encrypted and stored in Redis. After
this, the API servers will fetch the card data from Redis,
delete the key from Redis, and resubmit the data back to
the payment service via the payment service HTTPS SOA
client. During this process, the encrypted data is stored in
Redis only in-memory and data that is stored for morethan 120 minutes is securely deleted using the Redis
eviction component (deletion procedure in Redis). The
transaction is handled in API server memory only andauthorization of payment card transaction is handled in
the same methods as noted above in the Eventbrite
website section. Post authorization, Eventbrite does notstore cardholder data to file, disk, or database; nopayment card information is written, stored, or logged toany systems or within the application.
Ticket Transfers: In some cases, an attendee may havepurchased tickets to one event and may want to transfer
that ticket to another date. The transfer of this ticket, if
allowed, may incur fees or differences in price, which
need to be paid by the attendee. The website/ mobile web
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 5DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

user interface will first get the old and new event/ticket
information and inform the attendee on how much moneyis owed. If they continue, another form will prompt themfor payment card information to either get refunded or to
pay the difference. The attendees enter their name,address, PAN, card expiration date, and card verification
values (CVV2, CVC2, CID) similar to the Eventbrite
website dataflow discussed above. Ticket transfers uses
the web browser interface and communicates with
Eventbrite’s web servers via TLS 1.2 with at least
minimum of TLS_DHE_RSA_WITH_AES_128_CBC_SHA
128-bit encryption and maximum of
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256bit encryption or higher supporting the most secure
protocol and highest cipher that the attendee’s native
smartphone web browser can negotiate. Payment card
data received by this channel is handled the same way as
detailed above for the Eventbrite website. Eventbrite does
not store cardholder data to file, disk, or database.
Embedded Checkout Widget Transactions (iFrame): The
Embedded Checkout is a widget inside an iFrame thatconnects to the Eventbrite website over HTTPS using TLS
1.2 with AES 128-bit encryption. Data including cardholder
name, PAN and card expiration date is provided as part of
the ticket purchase flow. The request is forwarded to thefront end CloudFront load balancers which forwards it to
the API servers. The API servers then submit the card
data to payment service servers for payment processing.
The payment service abstracts the process of transaction
authorization and connects to the proper gateway tocomplete the transaction. Braintree, Cybersource andAdyen are payment gateways which settle the funds withthe bank accounts and return the tokenized form of the
PAN. This is stored in the payments database along withmasked PAN. Eventbrite does not store cardholder data tofile, disk, or database.
PayPal Embedded Checkout: In an embedded checkout
flow, the PayPal button redirects the event attendee to a
PayPal page where they can log in. Here PayPal
communicates with Braintree and requests a nonce which
is sent to the browser. The nonce is then forwarded to thefront end CloudFront load balancers using HTTPS withTLS 128-bit encryption, which is then forwarded to
Eventbrite's order service server. The order service thenpasses the nonce to the payment service server whichthen talks to Braintree and PayPal. Order service uses the
response from the payment service server and thePCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 6

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

payment is added to systems of record for financial
reconciliation, fees processing and other internal backoffice needs. Braintree eventually settles funds with themerchant banks.
Pay Invoices / Pay Refund Recharge Transaction: As partof the Eventbrite service, Eventbrite collects a variety offees for use of the service. In most of the cases,
Eventbrite acts either as the merchant of record or service
provider, so the fees incurred in the transaction are
deducted from the total being paid out to the organizer
leaving them with a net gross for their event. However,there are a variety of event configurations where
Eventbrite is facilitating the transaction. In these cases,
while Eventbrite does not charge credit card processing
fees, Eventbrite still has a per-ticket fee that needs to be
paid back. This fee is collected through a web userinterface. The organizer receives an email indicating they
owe fees with a link to their account details. After logging
in, the organizer will see the "Pay Via Credit Card" option
and then enters their PAN, card expiration date, and card
verification values (CVV2, CVC2, CID) like the Eventbrite
website. Pay invoices uses the web browser interface andcommunicates with Eventbrite’s web servers over HTTPS
using TLS 1.2 with at least minimum of
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption and maximum of
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256bit encryption higher supporting the most secure protocol
and highest cipher that the attendee’s web browser cannegotiate. Payment card data received by this channel ishandled the same way as detailed above for the
Eventbrite website dataflow. Eventbrite does not store
cardholder data to file, disk, or database.
A similar payment flow methodology is followed by Pay
Refund Recharge, where an attendee requests a refund
from an organizer after the accounts have been settledwith Eventbrite. In order to cover the cost of refund, theorganizer is requested to provide their credit card toprocess a payment for the amount they need to recharge
their account. They will then see a page asking them to‘Enter their Credit / Debit card info.’ This page will gather
the customer's PAN, card expiration date, and card
verification values (CVV2, CVC2, CID) like the Eventbrite
website. Payment card data received by this channel ishandled the same way as detailed above for the
Eventbrite website dataflow. Eventbrite does not store
cardholder data to file, disk, or database.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 7

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Partner Flow Using Card Data: This particular flow is forpartner systems but using card data. The partner systemtransmits the data token containing customer's name,
PAN, card expiration date and card verification values(CVV2, CVC2, CID) over to the Partner API, which
forwards the nonce to the front end CloudFront loadbalancers using HTTPS with TLS 1.2 and AES 128-bit
encryption. The load balancers will forward the data token
to the API server which then passes the Braintree or
Cybersource nonce to the payment service server for
payment processing. Payment service servers process
the notification by communicating with the order service
which marks the order status complete and logs the last-4
in the database. Payment is added to payment systems
for financial reconciliation, fees processing, and otherinternal back office financial processing needs.
Braintree/Cybersource eventually will settle the funds with
Eventbrite’s merchant banks.
Facebook API: Eventbrite and Facebook have launched apartnership that allows attendees to find events they wish
to attend through their social network on Facebook, andthen purchase tickets for these events directly on the
Facebook platform. The attendees can find events in theirnewsfeed or an organizer’s page. The event attendee
initiates the purchase process on the Facebook platform.
From this point, the event attendee can immediately clicka "Buy Now" button. They will be presented with a userinterface that allows them to select the number of tickets
they wish to purchase. Facebook will then collect thepayment card data (name, PAN, CVV, expiration date)from the event attendee and transmit this information toBraintree for processing. Braintree will process thetransaction and return status information back to
Facebook. When the transaction is complete, Facebook
will redirect the event attendee to the Eventbrite systems
with information about the transaction via TLS 1.2 with atleast minimum
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption to the Eventbrite load balancers / API servers
indicating the success/failure of the transaction including
payment amount, transaction ID and last 4 digits of the
PAN. This information is forwarded to the payment service
server, which communicates with the order service server
marking the order complete and logging the last 4 digits ofthe transactions to the EB and Payments databases.
Payment is added to the system for record for financial
reconciliation, fees processing and other internal back-

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 8DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

office needs. Facebook eventually settles the funds with
Eventbrite’s merchant banks.
Partner Flow Using Nonce: Partner system sends the data
token (name, PAN, CVV, expiration date) and initial
payment details to Braintree which returns a reply withnonce to Eventbrite load balancer. The load balancer will
forward the nonce to the payment service server forprocessing. The payment service transmits CHD to thegateway for processing the payment via HTTPS using
TLS 1.2 with AES 128-bit encryption. Payment service
servers process the notification by communicating with theorder service which marks the order status complete andlogs the last-4 in the database. Payment is added to
payment systems for financial reconciliation, fees
processing, and other internal back office financial
processing needs. Braintree eventually settles funds with
Eventbrite merchant banks.
Card-present transactions:
iOS and Android Organizer Mobile Application: Eventbrite
provides mobile applications that allows event organizers
to sell tickets “at the door”. The mobile applications aredeveloped internally by Eventbrite and available at theApple / Android stores. Apple iOS/Android applications
are developed for use by event organizers and venue
managers. These applications support both manual card
entry and magnetic stripe (Track 1/Track 2) data. The
following describes the card swipe using MagStripe card
readers payment processing flow:
iOS Organizer Application (U.S. POS): The iOS Organizer
Application is a mobile application written by Eventbrite forthe iOS platform. A swiped credit card transaction is
accepted using a MagStripe card reader connected to an
Apple iOS mobile device. The MagStripe readers are
manufactured by IDTech Products (iMagPro Mobile
MagStripe model, a payment supported magnetic stripe
device) and are sold to Eventbrite’s organizers for use
with the iOS Organizer application. The iMagPro Mobile
MagStripe reader uses DUKPT (Derived Unique Key Per
Transaction) key management with Triple DES (3DES)
encryption to encrypt Track1/Track2 data from each cardwith a unique 3DES key. The 3DES encrypted magnetic
stripe (Track1/ Track 2) data is passed to the Eventbrite
iOS application. The encrypted data is then transferred to
the Eventbrite API servers via HTTPS using TLS 1.2 withat least AES-128-bit encryption or higher supporting the
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 9DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

most secure protocol and highest cipher that the event
organizer’s native mobile device web browser cannegotiate.
Once the Eventbrite API servers receive the encrypted
data, the block of data must be further decrypted to get
the full Track 1/Track 2 card data. In this case, the API
server then sends the DUKPT encrypted data block to the
Eventbrite credit card decryption service (SSM) servers.
The server maintains the split knowledge, dual controlled
keys which replay the encryption sequence to derive thesymmetric key used to encrypt the data on the swipe
reader. The algorithm for key management used is the
ANSI X9.24 DUKPT standard. The Eventbrite SSM server
computes the encryption key, decrypts the block of data,
and returns the full Track 1/Track 2 data back to the API
server for transaction processing. Once the API server
receives the full Track 1/ Track 2 data from the SSM
server, the transaction is handled in API server memory
only and authorization of payment card transaction ishandled by payment processors in the same methods as
noted above in the Eventbrite website dataflow. Post
authorization, Eventbrite does not store cardholder data tofile, disk, or database; no payment card information is
written, stored, or logged to any systems or within theapplication.
iOS Organizer Application with Adyen Mobile Transaction(International POS): The iOS Organizer App is a mobile
application written by Eventbrite for the iOS platform
transactions, which allows organizers to sell tickets to theirevents at the door of their venue using the attendee’s
credit card information. This product is currently only
enabled for non-US venues. This product is tightly
coupled with the Adyen POS reader (a payment
supported magnetic stripe device), which does bothmagnetic stripe and chip-based capture of cardholder
data. The iOS app will capture the cardholder data (PAN,
CVV, expiration date) using the vendor-supplied API using
redirect, which is integrated into the iOS application. This
API will forward the captured information to Adyen Instant
Payment Notification (IPN) via HTTPS with TLS 1.2 using
128-bit encryption for processing and returns status
information. At this time, the organizer application willcomplete its payment processing by sending an Eventbrite
API request to the front end CloudFront load balancers
through to the API servers, which then store transaction
details in the EBProd and ProdPayments MySQL 5.7
databases. Asynchronous to this process, the Adyen
servers will return an API response directly to the
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 10DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Eventbrite API servers and that will update the payment
details, such as truncated PAN (last four digits of the PAN
or first six and last four digits of the PAN) and thereference token in the EB and ProdPayments MySQL
databases. Post authorization, Eventbrite does not store
cardholder data to file, disk, or database; no payment card
information is written, stored, or logged to any systems orwithin the application.
Android Organizer App: The Android Organizer App is a
mobile application written by Eventbrite for the Android
platform, which allows organizers to sell tickets to theirevents at the door of their venue using the attendee’s
payment card information. The swiped transaction is
accepted using a MagStripe card reader connected to an
Android mobile device. The MagStripe readers are
manufactured by IDTech Products (iMagPro Mobile
MagStripe model, a payment supported magnetic stripe
device) and are sold to Eventbrite’s organizers for use
with the Android Organizer application. The iMagPro
Mobile MagStripe reader uses DUKPT (Derived Unique
Key Per Transaction) key management with Triple DES(3DES) encryption to encrypt Track1/Track2 data fromeach card with a unique 3DES key. The 3DES encryptedmagnetic stripe (Track1/ Track 2) data is passed to the
Eventbrite iOS application. The Eventbrite iOS application
treats the encrypted block of data as an opaque block ofdata and then additionally encrypts it within the application
with RSA 2048-bit asymmetric encryption using an
Eventbrite’s RSA 2048-bit public key. The encrypted datais then transferred internally to the Eventbrite API servers
using HTTPS using TLS 1.2 with at least minimum
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption or higher supporting the most secure protocol
and highest cipher that the event organizer’s native mobile
device web browser can negotiate. Once the Eventbrite
API servers receive the encrypted data, it is decryptedwith the 2048-bit RSA private key and the block of data
must be further decrypted to get the full Track 1/Track 2
card data. In this case, the API server then sends the
DUKPT encrypted data block to the Eventbrite SSM
servers. The server maintains the set of derivation keys
necessary to compute what the encryption key for a given
card swipe on a given swipe device was at the time thecard passed over the magnetic card reader head. The
algorithm for key management used is the ANSI X9.24
DUKPT standard. The Eventbrite SSM server computes
the encryption key, decrypts the block of data, and returns
the full Track 1/Track 2 data back to the API server fortransaction processing. Once the API server receives the
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 11DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

full Track 1/ Track 2 data from the SSM server, thetransaction is handled in the API server. Now, the API
servers via the embedded order service will encrypt andstore the card data in-memory by fetching the dataencrypting key from Amazon KMS. Once KMS decrypts
the data-encrypting key, the card data is encrypted andstored in Redis. After this, the API servers will fetch thecard data from Redis, delete the key from Redis, andresubmit the data back to the payment service via the
Payment Service HTTPS SOA client. During this process,the encrypted data is stored in Redis only in-memory anddata that is stored for more than 120 minutes is securely
deleted using the Redis eviction component (deletion
procedure in Redis). The transaction is handled in API
server memory only and authorization of the payment cardtransaction is handled in the same methods as noted
above in the Eventbrite website section. Post
authorization, Eventbrite does not store cardholder data tofile, disk,or database; no payment card information is
written, stored, or logged to any systems or within theapplication.
Organizer App PayPal Here Card Present: The Organizer
App is a mobile application, which allows organizers tosell tickets to their events at the door of their venue using
the attendee’s credit card information. This product istightly coupled with the PayPal Here card reader (apayment supported magnetic stripe device), which does
both magnetic stripe and chip-based capture of cardholder
data. The PayPal Here readers communicate to themobile application using the SDK provided by PayPal. The
PayPal Here SDK notifies the Organizer app of thesuccessful transaction swipe by the reader, containing
card type and last 4 digits of the card. The Organizer App
then notifies Eventbrite API via a HTTPS request to
initiate the processing of the PayPal Here transaction.
Front end CloudFront load balancers forward the request
to payment service servers for processing. Payment
service responds with an ‘external reference’ identifier
used to identify the order at a later date. Organizer App
injects this external reference identifier into the order andprompts the PayPal SDK to process the order. SDK thensends magstripe and reference identifiers to PayPal for
payment processing. The SDK notifies the app of thesuccessful transaction, forwarding the successful invoice
id to order service to process the order. Payment service
uses the invoice number to request the transaction statusfrom PayPal to be returned to the Organizer App.
Payment service servers process the notification bycommunicating with the order service which marks the
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 12DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

order status complete and logs the last-4 in the database.
PayPal syncs with Braintree for settlement of funds andinformation of transactions. Payment gateways then settle
the funds with the Eventbrite bank accounts. The
accountability and ownership of the security of the PayPal
here card readers are solely a customer responsibility.
The customers purchase the PayPal Here card readers
directly from PayPal. At no point of this flow does
Eventbrite store cardholder data to file, disk, or database.
Bancontact and Adyen Transactions: The attendee places
an order using their Bancontact payment card on thedesktop application. A data token requesting the
cardholder name, PAN and card expiration date is routed
to the payment service server using HTTPS with TLS 1.2
and AES 128-bit encryption which routes to Adyen Instant
Payment Notification (IPN) System to be authorized.
Adyen then authenticates the card via 3DSecure and theuser is redirected to a page owned by the card issuer
bank. Adyen replies with payment session data. The user
confirms his credentials using a Quick Response (QR)
code/Scan/Credentials/PIN Number. The load balancers
then pass on this payment information to Eventbrite web
servers. This information is then forwarded to the payment
service servers after Adyen authorizes the transaction.
The payment completion data is saved by having the last
4 digits stored in the EB database. Payment is added tothe system of record for financial reconciliation, fee
processing and other internal back office financial
processing needs. The payment gateways eventually
settle funds with Eventbrite’s merchant bank account,
Wells Fargo, except for Adyen and all international
processing, which settles with JPMorgan.
Facilitated Payments:
Eventbrite also receives payment card transactions thatare facilitated through PayPal and Authorize.net. In thecase of facilitated payment card transactions, Eventbrite
does not receive the payment details; the payment data istransmitted directly from the end user to the facilitatedpayment provider. After payment processing, only thestatus of the transaction is stored in Eventbrite databases.
The payment flow for PayPal and Facebook is described
below.
PayPal Desktop / Mobile Web: Eventbrite allows
organizers to configure their events to accept PayPal as amethod of payment. In this case, Eventbrite redirects thecustomer’s browser or mobile application to the PayPal
PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 13DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

site upon which the PayPal IPN system is connected forinternal processing. The attendee enters transaction
details including the PAN, card expiration date, and card
verification values (CVV2, CVC2, CID) directly into the
PayPal web pages from their web browser via the redirectusing HTTPS/TLS 1.2 with at least minimum
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128-bit
encryption for authorization. After authorization, PayPal
returns a transaction status code, the last 4 digits of the
PAN, and the expiration date, which is stored in Eventbrite
EBProd and ProdPayments MySQL 5.6 databases. This
process is fully outsourced to PayPal, a PCI DSS v3.2.1
validated payment processor with AOC dated 02/13/2024.
Payment is added to the system for record for financial
reconciliation, fees processing and other internal backoffice needs. PayPal eventually settles funds with theorganizer’s merchant bank.
Authorize.net Transactions: Eventbrite allows organizers
to configure their events to accept Authorize.net as amethod of facilitated payment. In these cases, after
selecting a ticket type and quantity, the Eventbrite system
redirects the event attendee's browser to the
Authorize.net site to complete the transaction including
entry of any CHD necessary to complete that transaction.
CHD is transmitted using TLS 1.2 with AES 128-bit
encryption. Upon completion, the attendee's browser isredirected back to the Eventbrite system where they
finalize the order on the Eventbrite side and settle
transactions with the organizer’s merchant bank.
Simultaneously, Authorize.net will send a unique card
identifier to Eventbrite’s payment service server which
provides the success/failure of the transaction and themasked PAN (first 6 digits and last 4 digits) from the
Authorize.net side. This state is then recorded in both the
EB and Payments Databases.
Chargebacks: Eventbrite Finance team logs in over
HTTPS TLS 1.2 to the various payment providers andsettlement systems such as Well Fargo portal, Braintree,
Adyen to acquire chargeback batch files. Batch files
contain data tokens, masked PAN (first six, last four) andother transaction information. These files are retrieved
and uploaded over HTTPS TLS 1.2 to the Eventbrite
Administrative console (Chargeback Tool). Chargeback
batch files do not contain any sensitive cardholder data.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 14DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Part 2c. Locations
List types of facilities (for example, retail outlets, corporate offices, data centers, call centers, etc.) and asummary of locations included in the PCI DSS review.
Type of facility

Number of facilitiesof this type

Location(s) of facility (city, country)

AWS Hosted Data Center

2

US-East-1, US-West-2

Corporate Headquarters

1

San Francisco, CA

Corporate Offices

3

Madrid, Spain; Cork, Ireland; London,
England; Hyderabad, India; andMendoza Argentina

Part 2d. Payment Application
Does the organization use one or more Payment Applications?

Yes

No

Provide the following information regarding the Payment Applications your organization uses:
Payment Application
Name
Not Applicable

VersionNumberNot Applicable

Application
VendorNot Applicable

Is application
PA-DSS Listed?

Yes

No

PA-DSS Listing Expiry
date (if applicable)
Not Applicable

Part 2e. Description of Environment
Provide a high-level description of the environment
covered by this assessment.
For example:• Connections into and out of the cardholder data
environment (CDE).
• Critical system components within the CDE, suchas POS devices, databases, web servers, etc.,
and any other necessary payment components,
as applicable.

Eventbrite’s CDE is entirely hosted in dedicated AWS
cloud hosting environments, which are physically andlogically separated from the company’s corporate
offices and development/testing environments. There
are no direct physical or point-to-point Virtual Private
Network (VPN) connections between the production
CDE cloud environment and the Eventbrite corporate
office network or the development/testing
environments. The CDE is segmented from non-CDE
systems using virtual firewalls and Access Control
Lists (ACLs).
Inbound access from the Internet is allowed over asecure protocol and the highest cipher that thecustomer’s browser can negotiate to access the
Eventbrite web applications and to accept paymenttransactions. Remote access to the CDE is restricted
via session-based VPN, bastion hosts enabled withmulti-factor authentications.
Outbound connections are restricted to necessary
ports and protocols to support forwarding transactions
to payment processors for authorization.
The following support systems within the CDE wereassessed:- Virtual firewalls (security groups)- Servers- Load balancers- Server configuration management

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 15DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74- Multi-factor authentication- Access authorization- Audit log collection and analysis- Network time synchronization- Host-based Intrusion Detection System (HIDS)- File Integrity Monitoring (FIM)- Anti-virus- Change control management- External ASV vulnerability scanning- Internal vulnerability scanning- Penetration testing
Does your business use network segmentation to affect the scope of your PCI DSS
environment?
(Refer to “Network Segmentation” section of PCI DSS for guidance on network
segmentation)

Yes

No

Yes

No

Yes

No

Part 2f. Third-Party Service Providers
Does your company use a Qualified Integrator & Reseller (QIR)?
If Yes:Name of QIR Company:

Not Applicable

QIR Individual Name:

Not Applicable

Description of services provided by QIR:

Not Applicable

Does your company share cardholder data with any third-party service providers (forexample, Qualified Integrator & Resellers (QIR), gateways, payment processors, payment
service providers (PSP), web-hosting companies, airline booking agents, loyalty program
agents, etc.)?
If Yes:Name of service provider:

Description of services provided:

Amazon Web Services, Inc.

Cloud Hosting Provider

PayPal, Inc.’s Braintree Payment Processing System

Payment Processing

Cybersource Corporation

Payment Processing

Adyen N.V.

Payment Processing

Mercado Libre, Inc. (Mercado Pago)

Payment Processing

Stripe, Inc.

Payment Processing

Okta, Inc.

Authentication

Note: Requirement 12.8 applies to all entities in this list.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 16DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Section 2: Report on ComplianceThis Attestation of Compliance reflects the results of an onsite assessment, which is documented in an
accompanying Report on Compliance (ROC).
The assessment documented in this attestation and in the ROC was completed on:

03/15/2024

Have compensating controls been used to meet any requirement in the ROC?

Yes

No

Were any requirements in the ROC identified as being not applicable (N/A)?

Yes

No

Were any requirements not tested?

Yes

No

Were any requirements in the ROC unable to be met due to a legal constraint?

Yes

No

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 17DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Section 3: Validation and Attestation Details
Part 3. PCI DSS Validation
This AOC is based on results noted in the ROC dated 03/15/2024.
Based on the results documented in the ROC noted above, the signatories identified in Parts 3b-3d, asapplicable, assert(s) the following compliance status for the entity identified in Part 2 of this document(check one):
Compliant: All sections of the PCI DSS ROC are complete, all questions answered affirmatively,
resulting in an overall COMPLIANT rating; thereby Eventbrite, Inc. has demonstrated full compliancewith the PCI DSS.
Non-Compliant: Not all sections of the PCI DSS ROC are complete, or not all questions areanswered affirmatively, resulting in an overall NON-COMPLIANT rating, thereby Not Applicable has
not demonstrated full compliance with the PCI DSS.
Target Date for Compliance: Not ApplicableAn entity submitting this form with a status of Non-Compliant may be required to complete the Action
Plan in Part 4 of this document. Check with your acquirer or the payment brand(s) before completing
Part 4.
Compliant but with Legal exception: One or more requirements are marked “Not in Place” due to alegal restriction that prevents the requirement from being met. This option requires additional review
from acquirer or payment brand.
If checked, complete the following:
Affected Requirement
Not Applicable

Details of how legal constraint prevents requirement being met
Not Applicable

Part 3a. Acknowledgement of Status
Signatory(s) confirms:(Check all that apply)

The ROC was completed according to the PCI DSS Requirements and Security Assessment
Procedures, Version 3.2.1, and was completed according to the instructions therein.
All information within the above-referenced ROC and in this attestation fairly represents the results ofmy assessment in all material respects.
I have confirmed with my payment application vendor that my payment system does not store
sensitive authentication data after authorization.
I have read the PCI DSS and I recognize that I must maintain PCI DSS compliance, as applicable to
my environment, at all times.
If my environment changes, I recognize I must reassess my environment and implement any
additional PCI DSS requirements that apply.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 18

DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Part 3a. Acknowledgement of Status (continued)
No evidence of full track data1, CAV2, CVC2, CVN2, CVV2, or CID data2, or PIN data3 storage after
transaction authorization was found on ANY system reviewed during this assessment.
ASV scans are being completed by the PCI SSC Approved Scanning Vendor MegaplanIT Holdings
LLC.

Part 3b. Merchant Attestation/signhere/
Signature of Merchant Executive Officer 

3/18/2024 | 12:08 PM PDT
Date: /signeddate/

Merchant Executive Officer Name: Lanny Baker

Title: Chief Financial Officer

Part 3c. Qualified Security Assessor (QSA) Acknowledgement (if applicable)
If a QSA was involved or assisted with thisassessment, describe the role performed:

Conducted PCI DSS 3.2.1 remote onsite assessment anddocumented compliance results in a Report on Compliance andassociated Attestation of Compliance (AOC).

/cfosignhere/
Signature of Duly Authorized Officer of QSA Company 

3/18/2024 | 12:22 PM PDT
Date: /cfosigneddate/

Duly Authorized Officer Name: Christy Belknap

QSA Company: Coalfire Systems, Inc.

Part 3d. Internal Security Assessor (ISA) Involvement (if applicable)
If an ISA(s) was involved or assisted with thisassessment, identify the ISA personnel anddescribe the role performed:

Not Applicable. No ISAs were involved with this assessment.

1

Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities
may not retain full track data after transaction authorization. The only elements of track data that may be retained are primaryaccount number (PAN), expiration date, and cardholder name.

2

The three- or four-digit value printed by the signature panel or on the face of a payment card used to verify card-not-present
transactions.

3

Personal identification number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within
the transaction message.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 19DocuSign Envelope ID: C2E02DA8-7324-46C2-815E-899F255AAF74

Part 4. Action Plan for Non-Compliant Requirements
Select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement. If you
answer “No” to any of the requirements, you may be required to provide the date your Company expects tobe compliant with the requirement and a brief description of the actions being taken to meet the requirement.
Check with your acquirer or the payment brand(s) before completing Part 4.

PCI DSS
Requirement

Description of Requirement

Compliant to PCIDSS
Requirements(Select One)
YES

1

Install and maintain a firewall
configuration to protect cardholder data2

Do not use vendor-supplied defaults for
system passwords and other security
parameters

3

Protect stored cardholder data

4

Encrypt transmission of cardholder data
across open, public networks

5

Protect all systems against malware andregularly update anti-virus software or
programs

6

Develop and maintain secure systems
and applications

7

Restrict access to cardholder data bybusiness need to know

8

Identify and authenticate access tosystem components

9

Restrict physical access to cardholder
data

10

Track and monitor all access to network
resources and cardholder data

11

Regularly test security systems andprocesses

12

Maintain a policy that addresses
information security for all personnel

Appendix A2NO

Remediation Date andActions(If “NO” selected for any
Requirement)

Additional PCI DSS Requirements for
Entities using SSL/early TLS for CardPresent POS POI Terminal Connections

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Merchants r2© 2006-2022 PCI Security Standards Council, LLC. All Rights Reserved.

September 2022
Page 20