Security is central to how Toastie.io is built. This page summarizes our approach and how to report an issue responsibly.
How we protect data
- Least privilege. The database enforces row-level security, so each club and role only sees the data it should. Public visitors cannot read member contact details, meeting codes, or administrative tables.
- Server-side writes. Public submissions are handled by server actions using privileged credentials that are never exposed to the browser.
- Signed sessions. Member sign-in sessions are cryptographically signed and time-limited, and cookies are HTTP-only.
- Encryption in transit. The service is served over HTTPS.
- Hardening. We apply conservative security headers and keep public forms "fail-closed" so that a misconfiguration does not silently expose data.
Sign-in
Officers and administrators authenticate with Google; we never see your Google password. Platform administrator access is limited to accounts explicitly added by the platform owner.
Payments
The platform does not process payments and does not collect card details, which removes a major class of risk during the pilot.
Responsible disclosure
If you believe you have found a vulnerability, please contact us privately with enough detail to reproduce it, and give us a reasonable opportunity to respond before any public disclosure. Please do not access or modify other users' data, and do not run tests that could degrade the service for others.
No absolute guarantee
No online service can be completely secure. We work continuously to protect the platform, but we cannot guarantee absolute security.
Contact
Questions about this page? Contact us at Meet@Toastie.io.