Security at CricClubOS

Our commitment

CricClubOS stores personal data for club members — names, contact details, payment records, and attendance history. We treat that responsibility seriously. Security is not an afterthought; it is built into every layer of the platform.

Infrastructure

Hosting and data location

CricClubOS runs on Amazon Web Services (AWS). Data is stored in EU-region data centres. We do not store personal data outside the European Economic Area unless explicitly agreed with you in a Data Processing Agreement.

Encryption

• All data in transit is encrypted using TLS 1.2 or higher.
• Database volumes are encrypted at rest using AES-256.
• Sensitive tokens (such as identity tokens) stored in the database are encrypted at the application layer before persistence.

Database

We use Amazon RDS (PostgreSQL). Automated backups run daily with a 7-day retention window. Point-in-time recovery is enabled. Database instances are not publicly accessible; all connections are made from within a private VPC.

Authentication

Authentication is handled by Keycloak, an open-source enterprise identity platform. Keycloak manages user sessions, password hashing (bcrypt), brute-force protection, and optional multi-factor authentication. We do not store plaintext passwords anywhere in the system.

Admin accounts and member accounts are separated at the identity level. Elevated admin access is not accessible to regular club members.

Application security

Authorization

Every API route checks the caller's identity and club membership before processing a request. Club data is strictly isolated — one club cannot access another's members, finances, or configuration under any circumstances.

Input validation

All user-supplied input is validated on the server before being processed or stored. We use parameterised queries via Prisma ORM, which prevents SQL injection by design.

Dependency management

We keep our dependency tree up to date and monitor for known vulnerabilities using automated tooling. Security patches are applied as a priority.

Access controls

Access to production infrastructure is restricted to a small number of engineers and is protected by SSH key authentication. No passwords are used to access production systems. Access is reviewed periodically and revoked immediately upon team changes.

Logging and monitoring

Application logs and infrastructure metrics are collected and monitored for anomalous activity. We maintain audit trails for sensitive operations including member data changes, financial entries, and administrator actions.

Responsible disclosure

If you discover a security vulnerability in CricClubOS, we ask you to report it responsibly. Please do not disclose it publicly until we have had a chance to investigate and release a fix.

To report a vulnerability, email us at security@cricclubos.com. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots
• Your name / handle (if you would like credit)

We will acknowledge your report within 24 hours and provide an estimated timeline for resolution. We will keep you informed throughout the process. We currently do not operate a formal bug bounty programme, but we sincerely appreciate responsible disclosures.

GDPR and data protection

CricClubOS is designed to help clubs meet their GDPR obligations. As a data processor on behalf of your club, we sign a Data Processing Agreement (DPA) that sets out our responsibilities. See our DPA page and Privacy Policy for full details.

Questions

For any security questions not covered here, contact us at security@cricclubos.com.