Security
Payments and data, handled the way a bank would expect
OnTheTee never touches a card number, enforces access at the database level, and keeps every club's data completely separate from every other club's. By design, not by promise.
Payment security
We never see your card number
- Card payments are processed directly by Stripe and Paystack, both PCI DSS Level 1 certified processors, the strictest tier of card-industry compliance
- Our servers only ever receive confirmation that a payment succeeded and the amount, never the card itself
- Commission and payout amounts are calculated server-side from the processor's own confirmed transaction, never from anything a browser submits
- Refunds and payout corrections run through the same verified rails, end to end
Data protection
Access enforced by the database, not just the app
- Row Level Security is enabled on every table in our database. Access rules are checked by Postgres itself on every query, not only in application code
- A club can only ever see its own bookings, members, and staff, never another club's
- A golfer can only ever see their own bookings, memberships, and account details
- Data is encrypted in transit (HTTPS/TLS) and at rest
Account access
Two-factor authentication for club admins
- Managing staff, members, or club settings requires authenticator-app two-factor authentication, enforced at the database policy level, not just a login-time prompt
- Four staff roles (owner, admin, manager, starter), each scoped to exactly the access that role needs
- Golfers can delete their account at any time, with a 14-day window to change their mind before it's final
Data residency
Hosted in the EU, for every club we serve
- Our database runs in the EU (Ireland) regardless of where a club or its golfers are based
- Where data has to cross a border (South African payments via Paystack, for example), we rely on standard safeguards like EU Standard Contractual Clauses
- Full detail on what we collect and why is in our Privacy Policy
PCI compliance, handled for you
Card data never touches our servers. Stripe and Paystack carry that burden as PCI DSS Level 1 processors.
Row Level Security everywhere
Every table, every query, checked by the database itself, not just the application layer.
Found a security issue?
Tell us directly: hello@onthetee.appQuestions about how we handle your data?
The full privacy policy covers exactly what we collect, who we share it with, and why, or reach out directly.