A leading financial institution with multi-business operations inside a corporate group needed precise control over attendance at a high-profile executive conference. Andes Development designed and built, in one week, an event management and check-in platform on Laravel and Filament, with hardened authentication, full auditing, and multi-tenant capabilities. Six months later, the same platform moved into self-service: every guest now RSVPs, builds an agenda, and checks in from a personal link with a QR code, all of it in production.
// The challenge
Phase 1: a high-profile event with no tool (February - March 2026)
- Unified guest management There was no single platform for the attendee list, RSVPs, and real-time check-in.
- End-to-end traceability Full auditing (who registered whom, when, and how) was required to satisfy internal compliance controls.
- Bank-grade security Access protected with two-factor authentication, passkeys, and granular permissions.
- Group-level reuse The solution had to serve several companies in the group without duplicating infrastructure, with data isolated per entity.
- A critical timeline The platform was requested and deployed in one week.
Phase 2: from door control to guest experience (August - September 2026)
- Guests waiting on organizers Every RSVP, agenda change, or registration went through the events team.
- Events with multiple sessions Events grew into programs with open sessions and VIP-only sessions with limited seats.
- Rules that enforce themselves Registration, RSVP, and check-in windows the system respects without relying on anyone's memory.
- A public surface with no back doors Opening the platform to guests meant hardening that new surface to banking standards.
// The technology solution
Phase 1
- A modern stack A Laravel backend and a Filament 5 admin panel on PostgreSQL, with auditing and transactional logging.
- Multi-tenancy by scope One application and database for several companies in the group, with data isolated per entity.
- Hardened authentication Two-factor authentication (2FA), passkeys, and traditional credentials, aligned with bank-grade security standards.
- Check-in with traceability On-site registration with a timestamp and the identity of the operator behind every check-in.
- Real-time management Bulk participant import from Excel, RSVP tracking, and live editing from a simple interface.
Phase 2
- A guest portal Every participant gets a personal link with an opaque token and a QR code: from there they accept or decline, build an agenda, and check themselves in. The same link behaves differently for the guest and for signed-in staff.
- Sessions inside events Per-session RSVP and check-in, open or VIP-restricted access (by person or uploaded list), and optional capacity caps.
- A rules and windows engine Registration, RSVP, check-in, and event windows; staff can override with explicit confirmation, and every override is audited.
- A branded invitation page Layout templates, event banner, venue with a map link, a one-submit agenda, and QR codes with a center logo, downloadable as PNG and SVG.
- Secure integrations Inbound external forms through an HMAC-signed webhook with duplicate rejection, and seven automated notification types (reminders and a post-event feedback request) backed by a send-once ledger.
- QR door check-in Staff scan the guest's code; each participant's record shows per-session status and notification history.
- A hardened public surface A strict nonce-based CSP with no
unsafe-eval, guest pages that are uncached, referrer-free, and kept out of search engines, read requests that never change state, protection against formula injection in exports, and encrypted secrets. - An operator panel and no typed passwords A separate panel with mandatory two-factor; users set passwords from one-time links and choose their language, English or Spanish.
- An audit trail that answers who Every history entry names who acted, and every export of personal data is logged.
// Results and key wins
Two phases on the same foundation, replacing nothing and never lowering the security bar:
-
7 days
From request to certification and production for phase 1; refinements wrapped within 14 days total. -
Self-service
Guests who RSVP, build their agenda, and check in on their own, with VIP sessions and seat caps enforced by the system, now in production. -
Bank-grade security
2FA, passkeys, a strict CSP on the public surface, and a full audit of every action, for an operation that's traceable end to end.
// The bottom line
What started as a one-week build for a single event is now the group's corporate event platform: multi-tenant, auditable, and built around the guest. Phase two replaced nothing; it built on the same foundation, to the same security standard. Andes Development proved again that a critical timeline isn't at odds with bank-grade security, and that a solid foundation gets more valuable with every phase.