Product
Security at VioGolf
Tournament data is sensitive — handicaps, scores, payouts, player contact info. Here's how we protect it, in plain language.
Encryption in transit
Every request between your browser and VioGolf travels over HTTPS / TLS. Tournament scores, player data, and authentication tokens never cross the network in plaintext.
Passwords
We hash every password using bcrypt — the same algorithm major banks and identity providers use — with a high cost factor. Even if our database were ever compromised, raw passwords would not be retrievable.
We never email passwords. We never store them in plaintext. Password reset links use one-time tokens that expire and are invalidated on first use.
Role-based access
Every action inside a tournament is gated by a role grant. Owners, admins, scorers, and participants each see and can change only what their role permits. The system is the same whether a tournament has one organizer or fifty — there's no shared "admin password" floating around the clubhouse.
Owner
Full control. Can grant or revoke any role; only one owner per tournament.
Admin
Full edit access. Can manage players, scoring, results, and grant scorer/participant roles.
Scorer
Can post and edit scores. Cannot change tournament settings or grant access.
Participant
Read-only access to leaderboards and personal scorecards.
Payments
All payments are processed by Stripe. We never see, store, or transmit your card number — Stripe handles the entire payment capture flow, and we only receive a confirmation token. Stripe is PCI-DSS Level 1 certified, the highest level of payment-data security certification.
Data privacy
We collect the minimum data we need to run the service — see our Privacy Policy for the full list. We don't sell personal data. The only third parties we share data with are Stripe (for payments) and our hosting provider (to run the service). Both are contractually bound to use it only on our behalf.
Tournament data ownership
Your tournaments, scores, and player data are yours. You can export results to PDF or CSV at any time, and you can delete your account (and the associated data) on request — we'll process deletions within 30 days, subject to legally required retention (e.g. payment records).