How Paddles Up is built
The application runs on Vercel. Data lives in a managed Postgres database at Neon, in the United States. Reads reach your browser scoped to what you are allowed to see; writes go through a backend service that checks permission on every request.
Access to data
- The application connects to the database as a least-privilege role, not as the database owner. It holds only the grants it needs.
- Sign-in is by emailed one-time code, passkey, or Apple or Google. Sessions are held in cookies scoped to this site.
- Some Paddles Up staff can sign in as a user to reproduce a reported problem. That ability is restricted to the people who need it, and every use is recorded.
- Staff access to production is limited and reviewed.
Payments
Card details go from your browser to Stripe and never reach our servers. We hold a Stripe customer identifier; Stripe holds the card. Stripe is a PCI DSS Level 1 service provider. Money for an event moves into the Club's own Stripe account.
Encryption
TLS in transit. Encryption at rest at the database and storage layer. Secrets are held in a managed secret store and are not in the codebase.
Building the software
Every change is reviewed, and a fixed set of automated checks — types, lint, tests, house rules — must pass before it can be merged or deployed. Dependencies are pinned and updated. Access to the code and to the deployment pipeline is limited to the team.
Reporting a vulnerability
Write to security@paddlesup.io with what you found and how to reproduce it. We will acknowledge it and keep you informed.
We will not pursue legal action against anyone doing good-faith security research within these bounds: do not access another person's data beyond what is needed to demonstrate the issue, do not degrade the service, do not socially engineer our people or our providers, and give us reasonable time before publishing.
Incidents
If a security incident affects your personal information, we will notify you and any regulator that must be told, within the time the law requires. Clubs are notified within 72 hours of our confirming a breach affecting their data.
Certifications
Paddles Up holds no third-party security certification today. We are not SOC 2 audited and not ISO 27001 certified, and we would rather say so than imply otherwise. The controls above are what we have instead, and we will publish an audit result here when there is one to publish.
Subprocessors
The companies that process data on our behalf are listed at Subprocessors, with 30 days' notice to clubs before that list changes.