Security
Effective October 5, 2026
ClubNest is designed with organization isolation, authenticated access and least-privilege controls at the center of the platform. This page describes principal safeguards currently used by the service. It is not a guarantee of security, availability, regulatory compliance or an independent SOC 2, ISO or other certification.
1. Application and access security
- Authenticated sessions are required for protected organization areas. Private-file links are issued after an access check and may remain usable until their short expiry; do not share them.
- Authenticator-app two-factor authentication can be enabled for each personal account. Once enrolled, portal access requires a verified second factor or an explicitly remembered device. Where organization policy allows it, a remembered device can be valid for up to 30 days; it does not prevent inactivity logout. Password changes, factor changes and revocation invalidate remembered-device authorization.
- All portals sign out after ten minutes of inactivity. Password recovery does not remove an enrolled second factor.
- Organization records are scoped through database authorization policies so one organization is not intended to access another organization’s records.
- Administrative capabilities are separated from ordinary member access.
- Sensitive server-side operations use controlled service credentials rather than exposing privileged database credentials to browsers.
- Security headers are configured for the web application, including content-security controls, clickjacking protection and transport-security settings where supported.
2. Database security
ClubNest uses managed PostgreSQL infrastructure with Row Level Security for public application tables. Policies are designed around authenticated users and organization membership. Privileged database functions are restricted and use controlled execution settings.
3. Organization isolation
Customer workspaces are separate logical organizations. Access decisions use organization membership and role information. A new organization begins without another customer’s member records.
4. Data in transit and at rest
ClubNest uses HTTPS for web traffic. Data stored by our infrastructure may be encrypted at rest by the underlying provider. Encryption does not eliminate all security risk.
5. Operational security
- Source-control and automated build checks are used for application changes.
- Application behavior and service errors are monitored to identify operational issues.
- Supported dependencies are maintained and security updates are applied as part of ongoing maintenance.
- Privileged database operations and authorization changes are reviewed as the platform evolves.
6. Security incidents
We investigate suspected incidents and take reasonable containment and remediation steps. For a breach affecting customer personal information, we notify affected customers without undue delay after awareness and meet shorter applicable legal deadlines. Available information may be provided in stages; investigation does not postpone a notice that is legally due. Arizona and the affected individuals’ states may impose different notice requirements. The Data Processing Addendum describes our customer-processing obligations.
7. Customer responsibilities
Customers must configure appropriate administrators and permissions, remove stale access, protect credentials, decide what information to upload and maintain required notices or permissions. No platform can make an organization secure if credentials or permissions are misused.
8. Security reports
Report suspected vulnerabilities using the public contact below or your workspace. Include reproducible steps without other people’s private data. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and remediate it.