Security

Payments and data, handled the way a bank would expect

OnTheTee never touches a card number, enforces access at the database level, and keeps every club's data completely separate from every other club's. By design, not by promise.

Payment security

We never see your card number

  • Card payments are processed directly by Stripe and Paystack, both PCI DSS Level 1 certified processors, the strictest tier of card-industry compliance
  • Our servers only ever receive confirmation that a payment succeeded and the amount, never the card itself
  • Commission and payout amounts are calculated server-side from the processor's own confirmed transaction, never from anything a browser submits
  • Refunds and payout corrections run through the same verified rails, end to end

Data protection

Access enforced by the database, not just the app

  • Row Level Security is enabled on every table in our database. Access rules are checked by Postgres itself on every query, not only in application code
  • A club can only ever see its own bookings, members, and staff, never another club's
  • A golfer can only ever see their own bookings, memberships, and account details
  • Data is encrypted in transit (HTTPS/TLS) and at rest

Account access

Two-factor authentication for club admins

  • Managing staff, members, or club settings requires authenticator-app two-factor authentication, enforced at the database policy level, not just a login-time prompt
  • Four staff roles (owner, admin, manager, starter), each scoped to exactly the access that role needs
  • Golfers can delete their account at any time, with a 14-day window to change their mind before it's final

Data residency

Hosted in the EU, for every club we serve

  • Our database runs in the EU (Ireland) regardless of where a club or its golfers are based
  • Where data has to cross a border (South African payments via Paystack, for example), we rely on standard safeguards like EU Standard Contractual Clauses
  • Full detail on what we collect and why is in our Privacy Policy

PCI compliance, handled for you

Card data never touches our servers. Stripe and Paystack carry that burden as PCI DSS Level 1 processors.

Row Level Security everywhere

Every table, every query, checked by the database itself, not just the application layer.

Questions about how we handle your data?

The full privacy policy covers exactly what we collect, who we share it with, and why, or reach out directly.