Supabase (PostgreSQL) hosted on AWS infrastructure in the EU (Frankfurt). All data encrypted at rest using AES-256.
Application Hosting
Vercel edge network with automatic HTTPS/TLS 1.3. Global CDN for low-latency access.
Payments
Stripe processes all transactions. PCI-DSS Level 1 certified. We never store card numbers, CVVs, or full card details.
Authentication
Supabase Auth with bcrypt password hashing, JWT tokens, and configurable session management.
Data Isolation
Row-Level Security (RLS)
PostgreSQL RLS policies enforce strict tenant isolation. Every database query is filtered by club_id at the database engine level — not in application code. One club cannot access another club's data under any circumstances.
Role-Based Access Control
Three permission tiers: Owner (full control + billing), Admin (financial data + features), Viewer (read-only dashboards and reports). Owners manage team membership; role escalation is blocked by database triggers.
Workspace Isolation
Each club operates in a dedicated workspace. Team invitations require explicit owner approval. Access codes are single-use, rate-limited, and expire after use.
Encryption & Transport
In Transit
All connections use TLS 1.2+ (TLS 1.3 preferred). HSTS enforced. No unencrypted HTTP traffic is accepted.
At Rest
Database encrypted with AES-256. Automated encrypted backups retained for 30 days.
Session Management
JWT tokens stored in sessionStorage (cleared on tab close). No persistent cookies for authentication. Tokens have configurable expiry.
Application Security
Input Validation
All user inputs are validated and sanitized before processing. Zod schemas enforce type safety on financial data. DOMPurify sanitizes any rendered content.
Rate Limiting
Brute-force protection on authentication endpoints and access code redemption. Failed attempts are tracked and locked after threshold.
Content Security Policy
Strict CSP headers prevent XSS attacks. External scripts limited to Google Analytics. No inline scripts in production.
Dependency Management
Automated vulnerability scanning on dependencies. Minimal dependency footprint to reduce attack surface.
Testing & CI/CD
176+ automated tests covering financial calculations, input validation, CSV injection prevention, and UI components. Continuous integration runs lint, test, and build on every code change. Pre-commit hooks enforce code quality standards.
Audit & Compliance
Financial Audit Trail
Every change to financial data is logged with before/after values, user attribution, and timestamp. Audit logs are append-only and retained for up to 7 years for regulatory compliance.
Activity Logging
Admin actions (team changes, role updates, data exports) are logged in a separate audit trail. Logs cannot be modified or deleted by users.
GDPR Compliance
Full support for data subject rights: access, correction, deletion, export, and portability. Data Processing Agreement (DPA) available on request.
LGPD Compliance
Compliant with Brazil's Lei Geral de Proteção de Dados. Privacy policy available in Portuguese. Data deletion and export tools built into the platform.
Period Locking
Club owners can lock completed financial periods to prevent retroactive changes. Locked periods are enforced at the database level.
Infrastructure Partners
Supabase
SOC 2 Type II certified. ISO 27001. HIPAA compliant infrastructure. AWS-hosted with automatic failover.
Vercel
SOC 2 Type II certified. ISO 27001. Enterprise-grade edge network with DDoS protection.
Stripe
PCI-DSS Level 1 certified (highest level). SOC 2 Type II. ISO 27001.
Data Residency
All club financial data is stored in the European Union (AWS Frankfurt, Germany) via Supabase. Application hosting uses Vercel's global edge network with EU as the primary region. Payment data is processed by Stripe (PCI-DSS Level 1 certified). If your club has specific data residency requirements, contact us to discuss options.
Data Processing Agreement (DPA)
Our DPA covers GDPR (EU), UK Data Protection Act 2018, LGPD (Brazil), and Ley 25.326 (Argentina). It includes Standard Contractual Clauses (SCCs) for international data transfers, sub-processor details, breach notification procedures, and audit rights.
Enterprise tier customers can configure SAML 2.0 Single Sign-On for their organization. SSO enables centralized identity management, enforced MFA through your identity provider, and automatic user provisioning.
Enterprise tier customers can generate API keys for programmatic read-only access to their club data (scenarios, health scores, projections, compliance reports). API keys are SHA-256 hashed before storage — the raw key is shown only once at creation and never stored in plaintext. Each key has configurable rate limits (default: 100 requests/hour) and all API usage is logged for audit purposes.
Service Level Commitment
We target 99.5% platform uptime. Email support responds within 24 hours. During transfer windows (January and June-September), critical issues are prioritized with a 4-hour response target. Enterprise tier customers can negotiate custom SLAs with guaranteed uptime commitments and dedicated support channels.
Report a Vulnerability
If you discover a security vulnerability, please report it responsibly to security@zeladorfootball.com. We aim to acknowledge reports within 24 hours and resolve critical issues within 72 hours.