Security
A club's roster is a list of children, their parents and how to reach them. We treat it that way.
Last updated
Your club's data is scoped to your club
Every organization's records are isolated, and every request is checked against the organization the signed-in person belongs to. There is no shared view, and no cross-club list.
Roles, not an all-or-nothing login
Administrator, Operations, Coach, Player and Parent are distinct roles, enforced on the server rather than hidden in the interface. A coach sees the teams they coach and the families attached to them — not the club's whole contact database.
Accounts
- Passwords are stored hashed, never in plain text.
- Two-factor authentication is available, and repeated failed logins lock an account temporarily rather than allowing an unlimited guessing loop.
- Sessions are cookie-based and same-site, so another website cannot act as a signed-in user.
Payments
Card details are handled by Stripe and never touch our servers. Registration fees and tournament commitments are paid into your club's own Stripe account; we record the charge, the payment and the balance.
Links families receive
Some actions — answering an availability ask, committing to a tournament, updating email preferences — work from an emailed link without a password. Those links are single-purpose and expiring: they authorise exactly that one action for that one recipient, and grant no other access to the club.
Reporting a vulnerability
If you believe you have found a security issue, email support@bsblops.com with enough detail to reproduce it. Please do not disclose it publicly until we have had a chance to fix it. We will acknowledge your report and keep you posted on the fix.