Security and data protection

All your data is hosted by IONOS SARL, located in Sarreguemines, France, within European Union data centers. This guarantees that your information never leaves European jurisdiction.

All communications between your browser and our servers are protected by TLS (HTTPS) encryption, ensuring that no third party can intercept your data in transit.

Sensitive data stored in our databases benefits from encryption at rest, adding an additional layer of protection against unauthorized physical or logical access.

Automated daily backups with a rolling 90-day retention period ensure your data can be recovered in any situation. Backup integrity is regularly tested.

Each club’s data is logically isolated within our infrastructure, preventing any cross-access between organizations and ensuring strict confidentiality.

No encerramento da sua conta, os seus dados pessoais são eliminados ou anonimizados de forma irreversível, nos prazos e de acordo com as exceções legais detalhadas na nossa política de privacidade.

We implement a granular permission system that ensures each user only accesses the data and features corresponding to their role within the club. Permissions are configurable by administrators.

By default, users receive only the minimum permissions strictly necessary for their function. This approach minimizes the attack surface and limits the impact of any potential compromise.

Passwords are hashed using modern algorithms. Two-factor authentication (2FA) is available to add an extra layer of protection. Sessions are managed securely with automatic expiration mechanisms.

All sensitive actions such as role changes, data deletions, access modifications, and configuration changes are logged with full traceability, enabling thorough security reviews when needed.

User sessions are protected against hijacking and fixation attacks. Automatic timeouts ensure that inactive sessions are terminated, reducing exposure to unauthorized access.

Access to club spaces is controlled through a secure invitation system. No one can join a club environment without explicit authorization from an administrator.

Our development practices systematically integrate protection against the main application vulnerabilities identified by OWASP: XSS, CSRF, SQL injection, IDOR, and more.

We conduct regular security testing to proactively identify and fix vulnerabilities before they can be exploited, ensuring our platform stays ahead of emerging threats.

All third-party dependencies are regularly audited through automated tools to detect and patch known vulnerabilities, keeping our software supply chain secure.

Every code change undergoes systematic peer review before being deployed to production, ensuring quality, consistency, and the absence of security regressions.

Security is integrated at every stage of our development process, from design and architecture decisions to testing and deployment, following industry best practices.

Our systems are continuously monitored for unusual activity, performance anomalies, and potential security threats, with automated alerting to enable rapid response.

We use a centralized account management system that streamlines control and monitoring of user access to enhance security across all our internal systems.

We maintain the integrity and security of login credentials through a robust password management system. Two-factor authentication (2FA) is mandatory for all accounts, adding an essential layer of protection against unauthorized access.

Access privileges are carefully managed according to the principle of least privilege. Users only receive the minimum level of access required to perform their tasks, minimizing potential security risks.

We maintain a continuous watch on vulnerabilities, emerging threats and security best practices to proactively adapt our defenses and keep the platform up to date.

Security awareness is an ongoing commitment. Regular training, participation in professional security communities, and continuous self-education ensure that security decisions are always informed by the latest standards and threats.

A documented procedure enables us to detect, respond to, and communicate about security incidents swiftly and transparently, ensuring continuous improvement of our defenses.