Security
Platform security
Short and without marketing: how we protect club members' data. Only what already works.
Encryption
Data is protected in transit; passwords and conversations are protected at rest.
HTTPS only
The platform's website and API work only over an encrypted connection (TLS). A plain HTTP request is redirected to HTTPS straight away, and certificates renew automatically.
Passwords are only hashed
We never store passwords in plain text: the sign-in service keeps only their hash (bcrypt). Nobody can read your password, including the club team.
Encrypted conversations
Conversations with a personal AI assistant are stored encrypted in the database (AES-256-GCM), with a separate key for each assistant. Those keys are in turn encrypted with a master key in a cloud hardware key management module (Frankfurt). To reply, the assistant processes the message text: this is encryption at rest, not end-to-end.
Data access
Who sees what is decided by rules in the database itself, not only by the interface.
Rules in the database (RLS)
Requests from the browser and the mobile app go through row-level access policies. A private event is visible only to its organiser, invitees and administrators, and new tables with personal data are fully closed to such requests — only the server reads them, after checking who you are.
The database is not exposed to the internet
The database accepts connections only from our own server. Platform services run without superuser rights, and the service role with full access cannot sign in to the database directly.
AI staff with limited rights
The club's AI staff have read-only access to platform data. They can change something only through a few narrow actions, each checked by the platform itself.
Your data and erasure
Your GDPR rights of access and erasure are in your profile — no need to write to support.
A copy of your data
In your profile, under «My data and account», you can download the data the platform keeps about you.
Deleting your account
In the same place — «Delete my account and data». Once you confirm, all your sessions are closed and your data is erased from every place on the list where it is kept. Payment records stay, as the law requires, but without personal data. No access to your account? Write to serviceinfoclub@gmail.com.
AI assistants forget too
After erasure the platform notifies the club's AI assistants: they erase conversations, contacts and remembered facts about you, and no longer write to you first.
Where the platform runs
Our own servers, monitored from the outside.
Our own server in the EU
The platform's website, database, sign-in and files run on our own server in a DigitalOcean data centre in Frankfurt (Germany).
A separate server for AI assistants
The club's AI assistants run on a separate DigitalOcean server in Frankfurt (Germany). They get platform data only through its API.
Outside monitoring
The availability of the website, the API and the AI assistants is checked from outside, from several regions, every 1–5 minutes. The team is alerted if a service is down, an HTTPS certificate is about to expire or there is no fresh backup.
Logs without secrets
The server's request log does not store cookies, tokens or authorisation headers, and is deleted after 30 days.
Backups
Daily, and away from the main server.
Daily
Every day we back up the platform's database and files and the AI assistants' database, and check that each backup can be read in full.
Off the server
Each backup is also kept in Google Cloud Storage in Frankfurt, encrypted with our own key. The server can only add new backups: it cannot read, change or delete existing ones.
How long we keep them
On the server — 14 days (platform) and up to three months (AI assistants). In cloud storage, backups are deleted after 100 days.