Who Can See Your Guest List?

Kieran wrote earlier this month about connecting AI assistants to Eventogy, and the line people seem to have picked up on is this one: "Your assistant works with exactly the same permissions you have in Eventogy." It's a good line. It's also only reassuring if you know what your permissions are, and most events teams don't, mainly because nobody has ever needed to ask. So here's what they actually do, from the person who decided most of them.

Why the guest list matters more than anything else you hold

Anyone who has run a client dinner at a bank knows this already, but it's worth saying out loud. The guest list tells you which clients are being looked after, who is talking to whom, and occasionally what might be about to happen. It's sensitive before anyone has even turned up.

It's also the thing most likely to end up in a spreadsheet, attached to an email, with "final_v3" in the file name. I've seen a few.

Most of the risk sits in where the list goes after it leaves the platform. Verizon's 2025 Data Breach Investigations Report, based on 12,195 confirmed breaches, found third-party involvement in breaches had doubled to 30%. An assistant is one more third party. So before asking whether an assistant is safe, I'd want to know what it can get to.

“The guest list tells you which clients are being looked after, who is talking to whom, and occasionally what might be about to happen.

Who can see a guest list is set per event

In Eventogy you see the events you've been given access to, not everything on your firm's account. The full attendee database across every event is limited to a handful of account owners at each client. That's frustrating sometimes, but it is working entirely as intended.

The best example I have is a client running a big meetings programme who wanted every attendee to see every meeting, so their people could find each other during the day. Completely reasonable ask. The quick way to do it was one switch: everyone sees everything. I pushed back, because a switch like that gets turned on by accident, on the wrong event, the week the wrong guests are attending, and nobody notices until someone forwards a screenshot. So attendees see the meetings they've been added to, and that's it. Anything else opens up a security exposure you didn't even know existed.

It made that week harder for the client, and I don't enjoy saying no to people who pay us. Adding a colleague to an event at short notice is an extra step too. I'd still make the same call.

Exports are logged, and someone can see the log

We can't stop a list being exported once someone has the right to export it, and we shouldn't try. What we can do is make sure it's never quiet. Exporting a guest list, or pushing it into another system like a CRM, depends on the user's permissions, and every export is recorded. A client admin can see who took the list and when.

Sharing follows the same thinking. If a relationship manager needs to know who's coming, you share a live view with them rather than sending a file. You can see who has access and take it away from one person without affecting anyone else. Once it's revoked, it's gone from their side, which is more than you can say for an attachment.

How long attendee data stays with us is up to you, and you set it yourself through a self-service tool rather than emailing us and waiting.

The downside is that people sometimes have to ask before they can take a list, and they know their name is going in a log. A few find that a bit awkward. I'm fine with awkward.

Sign-in goes through your firm, with one exception

Your users sign in through your firm's identity provider, so your own rules apply, multi-factor authentication included. Single sign-on comes with every client at no extra cost. Charging for it always seemed odd to me, since all it does is make sure some clients go without.

There is one way in that doesn't go through your identity provider, and I'd rather tell you than have your IT team find it. When you share a list with a stakeholder, they're often someone your IT team doesn't manage, like a partner's assistant or a colleague in another part of the group. They get a sign-in link by email. We made those links short-lived and single-use, so an old email sitting in someone's inbox doesn't open anything, and they only see what was shared with them. Stakeholders do grumble about requesting a new link. That's the price.

What this means when you connect an assistant

This is the bit that made Kieran's job easier. An assistant connected to Eventogy works through your account, so it sees the events you can see and nothing else, and every lookup it makes is recorded. Initially the connection is read-only, and it can't send anything on your behalf. It doesn't get any access of its own. Everything I've described above was in place before it turned up, and that's really the point.

Most of what keeps a guest list safe is boring, and I'd like to keep it that way.

If you're thinking about connecting any assistant to your event data, ours or anyone else's, these are the three things I'd ask the vendor:

• Who can see a guest list, and is that set per event or across the whole account?
• When a list is exported or shared, is it recorded, and can our own admin see the record?
• Is there any way into the platform that doesn't go through our sign-in, and if so, what stops it being misused?

If you get clear answers, an assistant is just a quicker way to reach data that's already looked after. If you don't, I'd sort that out before connecting anything.