Security & Trust

Member data deserves serious treatment.

Volunteer-run committees still hold sensitive information about kids, parents and members. Here's how we keep it safe — in plain English.

How we protect your data

Six pillars, every one of them measurable rather than aspirational.

Every club, region and federation is a separate organisation. Postgres row-level security enforces the boundary on every query.

TLS 1.2+ in transit, AES-256 at rest. Backups are encrypted and stored in the same region as your primary data.

Production access is restricted to a small named team and gated behind SSO + hardware MFA. Every access event is logged.

Admin actions, role changes and configuration tweaks are recorded per organisation and exportable as CSV.

Daily encrypted backups retained for 30 days, with point-in-time recovery on Pro and Enterprise plans.

Primary infrastructure runs in Australia, aligned with the Privacy Act and the Australian Privacy Principles.

Where we are, what's in flight, and what we won't claim until it's audited.

Our internal controls are mapped to the SOC2 Trust Services Criteria. A formal Type 1 audit is on the roadmap.

Data minimisation, lawful basis tracking, and deletion-on-request are built into our admin tooling.

Default hosting in Australia, with notifiable-breach handling and APP-aligned data practices.

The vendors that touch your data. The full list lives in our sub-processors register.

Vendor	Purpose
Supabase	Postgres database, auth, storage
Vercel	Web hosting and edge runtime
Cloudflare	DNS, WAF and edge caching
Cloudflare R2	Object storage for media uploads
Stripe	Subscription billing and payments
Resend	Transactional and broadcast email
Inngest	Background jobs and scheduled tasks
Sentry	Error monitoring
Axiom	Application logging and analytics
Better Stack	Uptime and incident alerting

We take security reports seriously. Email security@clubhelix.au with details and we'll respond within one business day.