This page explains how we protect your account and your information, what you can do to stay safe, and how to tell us about a security weakness you have found. If you think your own account has been taken over, change your password straight away and contact us.

How we protect your account

Passwords. Passwords must be at least 10 characters. When you choose one, we check it against the Have I Been Pwned list of leaked passwords without sending the password itself, and refuse it if it has been leaked. We store passwords only as a one-way hash (bcrypt), so nobody at Rally & Roam can read them.
Two-factor sign-in. Coaches, club owners, club staff and administrators sign in with an authenticator app as well as their password. Other members get a one-time code by email as a second step. Codes expire after 10 minutes and stop working after 5 wrong tries. Authenticator secrets are stored encrypted.
Passkeys. You can add a passkey and sign in with your device's fingerprint, face or screen lock instead of a password.
Trusted devices. You can choose to trust a device for 30 days so you are not asked for a code every time. We keep only a coded copy of the trust token.
Sessions. You can see your active sessions and sign out of them from Settings. Sessions end after 2 hours without activity unless you ticked "Remember me".
Limits on repeated attempts. Sign-in, joining, password reset and code checks are limited to a few tries a minute to stop guessing.

How we protect the platform

Encrypted connections. The site is served only over HTTPS, and browsers are told to always use a secure connection (HSTS).
Security headers. Our pages tell browsers not to guess file types, not to let other sites frame them, to limit what is shared when you follow a link, and to block camera and microphone access.
Card details. Card details are entered with Stripe, our payment processor, and never reach our servers.
Encrypted secrets. Integration keys, partner webhook secrets and court camera stream addresses are stored encrypted.
Rate limits and bot checks. We limit how often payments, payouts, searches and contact details can be requested, and we use the Cloudflare Turnstile check on forms that attract abuse. Our acceptable use and anti-scraping policy explains these protections.
Restricted staff access. Only administrators can reach the back office, and they must use two-factor sign-in.
Backups. We back up the platform every night and test restoring a backup every week.
Error monitoring. Errors on our servers are reported to Sentry so we can spot and fix problems quickly. These reports do not include your name, email or IP address by default.

Keeping yourself safe

Use a password you do not use anywhere else, or a passkey.
We will never ask for your password or a sign-in code by email, message or phone.
Pay only through Rally & Roam checkout. Be wary of anyone who asks you to pay outside the platform.
Report suspicious messages or members with the report button.

Reporting a security weakness

If you believe you have found a security weakness in Rally & Roam, please tell us privately so we can fix it before it can be misused. Our contact details for security reports are also published in our security.txt file.

If that address is not shown, use the contact listed in the security.txt file. Please include:

a description of the weakness and the page, app screen or address where it occurs;
clear steps to reproduce it, with screenshots or a short video if that helps;
what you think the impact is;
how we can contact you.

Please write in English if you can.

Rules for good-faith research

We will not take legal action against you, or ask anyone else to, for research that is done in good faith and follows these rules:

only test against your own account, or accounts you have permission to use;
do not access, change or delete other people's information beyond the minimum needed to show the weakness, and stop and tell us as soon as you see personal information;
do not try to slow down or take down the service, and do not run automated scans that break our rate limits;
do not use social engineering, phishing or physical attacks against our members, partners or team;
do not make purchases or bookings you do not intend to keep, or move real money;
give us a reasonable time to fix the weakness before you tell anyone else about it.

This does not cover the services of other companies we use, such as Stripe or Cloudflare. Please report weaknesses in their services to them.

What happens next

We will acknowledge your report, look into it, and keep you updated on what we find and when it is fixed. If you would like to be credited once the weakness is fixed, tell us how. We do not run a paid bug bounty, so we cannot offer payment for reports.

Security and responsible disclosure