Your club’s data. Access under control.
Data protection has several layers: separating clubs, scoped permissions, encryption and access control. Here is what they mean in Sportago.
Clubs separated at database level
PostgreSQL Row-Level Security (RLS) restricts access to records belonging to the right club. This boundary does not rely solely on a user-interface filter.
A defined scope for every person
Roles and permissions control access to features and records. Coaches work within assigned scopes, guardians access data through verified participant relationships, and fans see their own purchases and whole-club events.
Encryption where it matters
TLS protects production connections. Selected sensitive fields use AES-256-GCM. This is not encryption of every field or end-to-end encryption; keys are kept separate from application code.
Sign-in and accountability
Authentication uses OpenID Connect. Permissions are checked by the server, not just by the page. Operation records help explain changes without including full sensitive content.
Club database hosted in Poland
The club application database is hosted in Poland. The public website and its form use Cloudflare’s global network, and correspondence uses an email provider. Database location does not mean all supporting services operate only in Poland.
Reporting concerns and responsibilities
Correct permissions, verified guardians and secure accounts matter as much as technology. Report suspected unauthorised access to [email protected]. Separate terms and a data processing agreement define club data processing.