We keep Golf Buddies secure with encryption, strict server-side authorization, and least-privilege access — and we're transparent about where we stand on formal compliance.
Real controls that are in place today.
HTTPS everywhere, with HTTP Strict Transport Security (HSTS) enforced at the edge.
Your data lives in managed Postgres (Supabase), encrypted at rest by the provider.
Access is enforced in the database with Row-Level Security — not just hidden in the UI. Every API call verifies your identity.
Privileged keys stay server-side and never reach the browser. Secrets live in environment variables, never in our code.
A Content-Security-Policy plus anti-clickjacking and MIME-sniffing protections limit what can run and where data can go.
We validate input on the server and escape output to guard against injection and cross-site scripting.
Sensitive actions like emailing results are rate-limited, and access-code redemption is enforced atomically in the database.
Delete your account and data at any time from the in-app Account menu. See our privacy policy.
Found a bug? We publish a security contact and welcome good-faith reports (details below).
We believe in being honest about certifications. Here's the current, accurate status — no badges we haven't earned.
| Framework | Status | What it means |
|---|---|---|
| SOC 2 | Working toward | We are building our security program against the SOC 2 Trust Services Criteria. We are not yet SOC 2 audited or certified, and we won't claim to be until an independent auditor's report is in hand. |
| ISO/IEC 27001 | Working toward | Our controls are being mapped to ISO 27001 Annex A. We are not yet ISO 27001 certified; certification requires an accredited registrar's audit, which we have not completed. |
| HIPAA | Not applicable | Golf Buddies is a golf scores app and does not handle Protected Health Information (PHI). HIPAA does not apply, and we ask that you not enter health information into the app. |
SOC 2 and ISO 27001 are earned through independent audits over time, not overnight. If you're evaluating Golf Buddies for your organization and need specific documentation, get in touch — we're happy to share our current security posture.
If you believe you've found a security vulnerability, please email us at info@cooppetition.com. Include what you found, how to reproduce it, and the potential impact.
Please act in good faith: don't access or modify other users' data, and give us a reasonable window to fix the issue before any public disclosure. Machine-readable contact details are at /.well-known/security.txt.
We're grateful for responsible disclosure and happy to credit reporters who'd like to be named.
We're glad to talk through our controls and roadmap with your team.
Contact us