Football club data,
kept safe.
No numbers here that aren't true, and no numbers we haven't measured yet. This is what is in place today, and the two figures we are still waiting to publish.
Eight things, checked.
Security is not a page of promises separate from the product. Each of these is part of how the platform runs, not a setting a club has to go and find.
Where your data lives
Your data is stored in the UK
Club data lives in Supabase's UK region (eu-west-2). Our hosting and email providers may process some data in the EU or the United States, under UK transfer safeguards, and the privacy notice says which.
Encrypted in transit and at rest
Every connection to the platform runs over TLS, and the database encrypts data at rest. There is no plain-text path between a browser and a club's records.
Who can get in
An emailed sign-in code on every new device
After a password, a six-digit code is emailed to the account holder before they get in on a device we haven't seen. The code lasts ten minutes, and a device is trusted for 30 days, or until it has sat idle for 7. Parents and players have no password at all: the emailed link or code is how they sign in. Our own platform staff add an authenticator app on top. We don't send codes by text message.
Access on a need-to-know basis, medical notes logged
Role-scoped access decides what a person can see, and every time someone opens a child's medical notes or emergency contacts, it is logged.
If something goes wrong
Encrypted backups
Backups are encrypted and kept by our database provider.
A proper place to report a problem
Found a security issue? Email security@thefullsquad.com. There is also a standard security.txt at /.well-known/security.txt for anyone whose tooling looks for one first.
What we publish
A published list of who else touches your data
Every sub-processor we use is named in the data processing terms, so a club can see exactly who else the data passes through and why.
Built around the rules for children's data
Consent, retention and who can see what for under-18s are enforced in the platform itself. The detail is on the safeguarding page.
The two numbers we won't guess at.
We would rather say nothing than publish a number we haven't measured. Both will be published here once our restore test has run.
How fast we are back up, and how much a club could lose. Measured on the live platform, published here at launch, not guessed.
How quickly we would tell you if something went wrong. Measured on the live platform, published here at launch, not guessed.
How we handle data as your processor is set out in full in the data processing terms, and how we protect children specifically is on the safeguarding page.
Questions clubs ask
The questions we get asked most, answered straight. If yours is not here, email info@thefullsquad.com.
Where is the data stored?
Club data lives in Supabase's UK region (eu-west-2). Our hosting and email providers may process some data in the EU or the United States, under UK transfer safeguards.
Is my club's data encrypted?
Yes. Every connection runs over TLS, and the database encrypts data at rest. There is no plain-text path between a browser and a club's records.
How does sign-in work?
Everyone gets a six-digit code by email on a new device, after their password. The code lasts ten minutes. A device is trusted for 30 days, or until it has been idle for 7. Parents and players have no password: the emailed link or code is how they sign in. Our own platform staff also use an authenticator app. There are no text-message codes.
What happens if something goes wrong or data is lost?
Backups are encrypted and kept by our database provider.
How do I report a security issue?
Email security@thefullsquad.com, or use the standard security.txt at /.well-known/security.txt.
Your data, still yours.
Leave and you get 30 days to ask for your export, and that includes the records that matter most. Leave an email and you'll see the rest take shape.