Organisation isolation
Every club, region and federation is a separate organisation. Postgres row-level security enforces the boundary on every query.
Security & Trust
Member data deserves serious treatment.
Volunteer-run committees still hold sensitive information about kids, parents and members. Here's how we keep it safe — in plain English.
How we protect your data
Six pillars, in plain English.
Encryption
TLS 1.2+ in transit, AES-256 at rest. Backups are encrypted and stored in the same region as your primary data.
Least-privilege access
Production access is restricted to a small named team and gated behind SSO + hardware MFA. Every access event is logged.
Audit log
Admin actions, role changes and configuration tweaks are recorded per organisation and exportable as CSV.
Backups & recovery
Daily encrypted backups retained for 30 days, with point-in-time recovery on Pro and Enterprise plans.
Australian-hosted
Primary infrastructure runs in Australia, aligned with the Privacy Act and the Australian Privacy Principles.
Why this matters more than it did
“We’re too small for the Privacy Act” used to end the conversation.
The small-business threshold has not moved — it is still $3 million in annual turnover, and most community clubs sit well under it. What has changed is how much that answer is worth.
On 10 June 2025 a statutory tort for serious invasion of privacy commenced. It matters to a small club for one structural reason: it is broader in application than the Privacy Act and extends to entities that may not necessarily be an APP entity. So a committee that has satisfied itself the club is under $3 million in turnover has answered the Privacy Act question and not the privacy question.
There is a second trapdoor in the exemption itself. The OAIC’s own worked example of a club losing it is a club running a program to assist members with injuries or to improve fitness or health — that is providing a health service, and it brings the club under the Act whatever its turnover. Worth reading twice if your club runs a return-from-injury program.
None of that makes a committee negligent. It does mean the honest answer to “who can see our members’ medical notes?” should come from the software, not from a spreadsheet’s sharing settings. This is general information rather than legal advice.
What we built for it
Five things that are properties of the database rather than promises about our conduct — which is the only kind of assurance worth giving a volunteer committee.
The audit log cannot be rewritten — not even by us
Admin actions, role changes and configuration changes are recorded per organisation, and the database physically refuses to alter or delete an entry. Platform staff were deliberately stripped of that power, and the rule sits below the permission system, so an administrator, a support session and an automated job are all equally unable to edit history. The only permitted change is detaching an erased member’s name, which is a privacy step rather than an edit.
Separation is enforced by the database, not by our code
Row-level security is enabled and forced on all 275 tables, so a query that forgets to filter by organisation returns nothing rather than somebody else’s members. A check runs on every build and fails it if a new table ships without that protection — the protection cannot quietly lapse as the product grows.
We audit our own public pages for data we never meant to expose
In September 2026 we went looking for information our own public pages could return but never displayed, and found three cases: club contact details, a team manager’s account reference, and contact details on members-only events. All three were closed the same month, and the fix was written so that a field added in future is invisible to the public by default rather than exposed until somebody notices.
Erasure is decided field by field, not by deleting the person
When a member asks to be erased, medical notes, date of birth, gender, emergency contacts, email, phone and photo are destroyed. Names already written into signed waivers, incident reports, complaints and meeting minutes are kept, because those are point-in-time legal records: a register that forgets who a complaint was about is not a register. Reported chat messages with an unresolved report are never purged either, because deleting them would destroy the safeguarding trail.
Nobody is using the product on terms they never saw
When your terms or privacy policy change, signed-in members are asked to accept the new version before they can keep using the site — while still being able to read what changed first. Two-factor authentication is available to every account and, once someone turns it on, it is required again at every admin entry point rather than trusted from the morning’s login.
Compliance posture
Where we are, what's in flight, and what we won't claim until it's audited.
SOC2-aligned controls
Our internal controls are mapped to the SOC2 Trust Services Criteria. A formal Type 1 audit is on the roadmap.
GDPR-aligned data handling
Data minimisation, lawful basis tracking, and deletion-on-request are built into our admin tooling.
Australian Privacy Act
Default hosting in Australia, with notifiable-breach handling and APP-aligned data practices.
Sub-processors
The vendors that touch your data. The full list lives in our sub-processors register.
| Vendor | Purpose |
|---|---|
Vercel | Web hosting and edge runtime |
Supabase | Postgres database, auth and file storage |
Stripe | Subscription billing and payments |
Amazon Web Services (Amazon SES) | Transactional and broadcast email |
Twilio | SMS, for organisations that switch it on |
Sentry | Error monitoring |
Axiom | Application logging |
Inngest | Background jobs and scheduled tasks |
Google | Optional Google sign-in, and Search Console for verified domains |
Anthropic | The optional Helix Assistant |
When something goes wrong
Reliability is a trust promise too. Bugs happen in every product — what matters is whether they get noticed, reported and fixed, or quietly ignored.
Monitored, not assumed
Every page reports crashes automatically — and also the failures that never throw an error, like a button that does nothing when clicked or a request that fails behind the scenes.
One-click bug reports
Every signed-in user can report a bug in one click — throughout the admin, from their account page, and on any error screen. The report carries the page and recent errors, and from an error screen it files onto the same tracked issue as the crash itself — so it reaches the engineer with the evidence attached.
Privacy-safe diagnostics
Screen recordings are captured only when an error occurs, and text, inputs and media are masked by default — member rosters, waivers and payment fields never appear in recordings.
Watched around the clock
Synthetic checks exercise the platform continuously, background jobs report their failures like any other error, and the live service status is public on our status page.
Want to see the product before trusting it with a season? The live demo is open to anyone — no sales call, no sign-up wall. Current platform health is always visible on the service status page. See how our team finds and fixes bugs for you.
Found a vulnerability?
We take security reports seriously. Email security@clubhelix.com with details and the team will review your report.