Security
How we protect your club's financial data
Architecture
Database: Supabase (PostgreSQL) on AWS EU (Frankfurt), AES-256 encryption at rest. Hosting: Vercel edge network with TLS 1.3. Payments: Stripe (PCI-DSS Level 1).
Data Isolation
Row-Level Security (RLS) enforces strict tenant isolation at the database engine level. Role-based access control (Owner, Admin, Viewer). Single-use, rate-limited access codes.
Encryption
All data encrypted in transit (TLS 1.2+) and at rest (AES-256). HSTS enforced. JWT tokens in sessionStorage only.
Application Security
Zod schema validation, DOMPurify sanitization, strict CSP headers, rate limiting on auth endpoints, minimal dependency footprint.
Compliance
Financial audit trail (7-year retention), GDPR compliant, LGPD compliant, Data Processing Agreement available. Period locking for completed financial periods.
Infrastructure Partners
Supabase (SOC 2 Type II, ISO 27001), Vercel (SOC 2 Type II, ISO 27001), Stripe (PCI-DSS Level 1, SOC 2 Type II, ISO 27001).
Enterprise SSO
SAML 2.0 Single Sign-On available for Enterprise tier. Contact: enterprise@zeladorfootball.com
DPA
Data Processing Agreement covering GDPR, UK DPA 2018, and LGPD available on request. Contact: legal@zeladorfootball.com
Report vulnerabilities: security@zeladorfootball.com
Back to homepage