Security Policy

In transit: All data transmitted between your browser or mobile app and our servers is encrypted using TLS 1.2+ (HTTPS). This prevents anyone from intercepting your information.

At rest: Sensitive data such as passwords are hashed using bcrypt with a cost factor of 12, making them computationally infeasible to reverse. NZ Golf credentials are encrypted using AES-256-GCM with authenticated encryption, ensuring both confidentiality and integrity.

Secrets management: API keys, encryption keys, and other secrets are stored as environment variables on secured infrastructure — never in source code or client-side bundles.

We use industry-standard JWT-based authentication via NextAuth.js with session tokens that expire automatically. All authenticated routes are protected by middleware that verifies your identity before granting access.

Multi-provider SSO: Sign in securely via Google, Apple, or email/password. OAuth tokens from third-party providers are never stored — only your verified email and account identifier are retained.

Password security: We enforce minimum password length requirements and use bcrypt (12 rounds) for hashing. Passwords are never stored in plain text, logged, or exposed in API responses.

All sensitive endpoints are protected by rate limiting to prevent brute-force attacks and abuse:

• Login attempts: 5 per minute per IP address
• Signup attempts: 3 per minute per IP address
• Password reset requests: 3 per 5 minutes per IP address
• API requests: 60 per minute (general), 30 per minute (write operations)
• Account deletion: 2 per hour per IP address

Rate-limited responses include a Retry-After header so your browser knows when to retry.

All user input is sanitised on the server side before processing. This includes:

• HTML tag stripping and control character removal to prevent cross-site scripting (XSS)
• Email validation against RFC 5322 standards
• Strict type checking and bounds validation for numerical inputs (scores, handicaps)
• Name sanitisation with length limits (max 100 characters)
• UUID format validation for all record identifiers

We maintain comprehensive audit logs for over 30 types of security-relevant events, including:

• Login and signup attempts (successful and failed)
• Password changes and account deletions
• SSO authentications (Google, Apple, NZ Golf)
• Rate limit violations
• Subscription and billing events
• Profile modifications and data exports

Each log entry captures a timestamp, action type, anonymised IP address, user agent, and success/failure status to help identify and respond to suspicious activity.

Our application enforces the following HTTP security headers on all responses:

• Strict-Transport-Security (HSTS): Forces HTTPS with a 2-year max-age and preload support
• X-Content-Type-Options: Prevents MIME-type sniffing attacks
• Referrer-Policy: Limits referrer information sent to external sites
• Permissions-Policy: Restricts access to sensitive browser APIs (camera, microphone)

Payment security: All payment processing is handled by Stripe, a PCI-DSS Level 1 compliant payment processor. We never store, process, or transmit credit card numbers — Stripe handles this entirely. Webhook events from Stripe are verified using cryptographic signatures before processing.

We believe you should have full control over your data:

• Export: Download all your personal data and round history at any time from Profile → Export Data
• Delete: Permanently delete your account and all associated data from Profile → Delete Account
• Correct: Update any inaccurate information directly in your Profile settings
• Unlink: Disconnect third-party integrations (NZ Golf) at any time

For more details about how we collect, use, and protect your data, see our Privacy Policy.