Security
Protect club data with clear, practical controls
Tenant isolation, authentication, role-based access, 2FA, and elevated protection for medical and financial resources — hosted in the EU on Contabo infrastructure.
Principles
Tenant isolation
Every request is scoped to your club tenant. Other organisations on the platform do not share your operational data.
Least privilege by role
Permissions map roles to resources and actions — view, create, edit, approve, export, and more — so staff only see what their job requires.
Honest claims
We describe controls we implement. We do not claim “bank-level” security, invented certifications, or blanket full GDPR compliance.
Controller / processor clarity
Designed to support GDPR-aligned processing: your club is the controller of personal data; My Club Hub acts as processor. See Data Processing for more.
Access controls
- JWT authentication for API sessions
- Role-based access control across modules
- Two-factor authentication (2FA) available
- Elevated protection for medical, contracts, finance, payments, and audit-sensitive resources
- Session expiry; unauthorised responses clear local session and return users to sign-in
- Google / Microsoft OAuth available when credentials are configured
- Enterprise SSO Planned
Medical data protection
Medical notes and related resources are treated as sensitive. Access is limited to permitted roles. My Club AI may summarise only what a user is already allowed to see, and must not be used for medical diagnosis — clinical decisions stay with qualified staff.
Audit & accountability
Sensitive areas are designed with audit-minded controls so clubs can understand who accessed or changed critical records. Export, deletion, and consent-related flows exist to help clubs respond to GDPR-aligned requests; lawful basis and policy remain the club’s responsibility as controller.
Hosting
Data is hosted in the EU on Contabo infrastructure (Contabo VPS). We do not invent additional compliance badges. For processing details, see Data Processing and the Security Centre.