Freyaa runs the same plumbing your bank's developers do — strict tenant isolation, audited admin actions, encrypted traffic, EU-resident Postgres. None of it is exotic; all of it is wired in.
The unsexy plumbing that every committee asks about. Plain English versions of how we handle each one.
Each club has its own subdomain and its own row-set. The middleware resolves the tenant from the URL and stamps every server-side query with that tenant id. A booking, member or audit row from one club is unreachable from another, even if a request asks for it directly.
Sessions are HTTP-only cookies signed with a rotating server secret. Passwords use argon2id (memory-hard, side-channel-resistant). Per-account brute-force lockout, IP and user-agent recorded on every sign-in.
All traffic is HTTPS — apex and every per-club subdomain. SSL certificates are auto-provisioned. Postgres is encrypted at rest by Neon; backup snapshots inherit the encryption. Stripe handles cards directly; we never see card numbers.
Bookings, members, courts, rules, tournaments and staff roles all land in an append-only audit log. Owners can search by actor, action or entity; the log is exportable for committee reviews. Soft-delete on every entity, so an accidental change is recoverable.
Postgres is backed up continuously by Neon — we can restore the database to any point in the last 7 days. Daily snapshots are retained for 30 days. RPO (recovery point objective) is <5 minutes; RTO (recovery time objective) is <1 hour for the platform and same-day for an individual club requesting a rollback.
Found something? Email security@freyaa.club. We respond within one working day, acknowledge the report, and keep you posted while we work on it. We don't have a paid bug bounty yet, but credible reports get credit and a thank-you.
Data resides in the EU. Our DPA, sub-processor list and privacy policy are public. We're happy to fill in a security questionnaire — email hello@freyaa.club.
Each has a Data Processing Agreement on file. The list updates when the architecture changes — there's no hidden tier of vendors.
Hosting & CDN edge
Postgres database
DNS, WAF, R2 storage
Payments & Connect
Transactional email
Redis (rate limit, idem.)
Background jobs
Weather forecasts
Logs & errors
We've answered most of them — happy to send our standard responses for a SOC 2 / ISO 27001-style review.