Security at CricClubOS

Our commitment

CricClubOS stores personal data for club members — names, contact details, payment records, and attendance history. We treat that responsibility seriously. Security is not an afterthought; it is built into every layer of the platform.

Infrastructure

Hosting and data location

CricClubOS runs on Google Cloud in the Toronto region (northamerica-northeast2). Production application workloads run on Cloud Run, the database runs on Cloud SQL, and uploaded files are stored in Cloud Storage.

Encryption

• All data in transit is encrypted using TLS 1.2 or higher.
• Database volumes are encrypted at rest using AES-256.
• Sensitive tokens (such as identity tokens) stored in the database are encrypted at the application layer before persistence.

Database

We use Google Cloud SQL for PostgreSQL. Automated backups and point-in-time recovery are enabled. The database is not publicly exposed; connections are restricted to authorised Cloud Run workloads.

Authentication

Authentication is handled by CricClubOS's application-managed identity service. Passwords are hashed with bcrypt, sessions are protected with signed tokens, and we never store plaintext passwords.

Admin accounts and member accounts are separated at the identity level. Elevated admin access is not accessible to regular club members.

Application security

Authorization

Every API route checks the caller's identity and club membership before processing a request. Club data is strictly isolated — one club cannot access another's members, finances, or configuration under any circumstances.

Input validation

All user-supplied input is validated on the server before being processed or stored. We use parameterised queries via Prisma ORM, which prevents SQL injection by design.

Dependency management

We keep our dependency tree up to date and monitor for known vulnerabilities using automated tooling. Security patches are applied as a priority.

Access controls

Access to production infrastructure is restricted to a small number of engineers through Google Cloud IAM. Deployments use short-lived GitHub OIDC credentials rather than long-lived service-account keys or server SSH access. Access is reviewed periodically and revoked immediately upon team changes.

Logging and monitoring

Application logs and infrastructure metrics are collected and monitored for anomalous activity. We maintain audit trails for sensitive operations including member data changes, financial entries, and administrator actions.

Responsible disclosure

If you discover a security vulnerability in CricClubOS, we ask you to report it responsibly. Please do not disclose it publicly until we have had a chance to investigate and release a fix.

To report a vulnerability, email us at security@cricclubos.com. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots
• Your name / handle (if you would like credit)

We will acknowledge your report within 24 hours and provide an estimated timeline for resolution. We will keep you informed throughout the process. We currently do not operate a formal bug bounty programme, but we sincerely appreciate responsible disclosures.

GDPR and data protection

CricClubOS is designed to help clubs meet their GDPR obligations. As a data processor on behalf of your club, we sign a Data Processing Agreement (DPA) that sets out our responsibilities. See our DPA page and Privacy Policy for full details.

Questions

For any security questions not covered here, contact us at security@cricclubos.com.