Security and Data Protection for Australian Clubs
Your club holds personal information about its members — names, addresses, contact details, licence numbers, and records members reasonably expect to stay private. Committees change, volunteers come and go, and the people responsible for that data are rarely IT specialists. This page sets out plainly where your data lives, who can reach it, and what protects it.
Hosted in Australia
Your member records, attendance and scores are stored in Sydney and stay onshore.
Encrypted end to end
Data is encrypted in transit and at rest, with daily backups and restore capability.
Every action logged
Activity and login history mean you can always establish who changed what, and when.
Why Club Data Security Is Usually Misunderstood
Most committees worry about the wrong thing. The instinct is that data stored online is exposed and data kept locally is safe, but in practice it is usually the reverse. A spreadsheet exported for a report does not stay in one place. It gets emailed to two committee members, opened on a home laptop, edited, sent back, and a copy lands in someone's personal cloud drive. Six months later there are five versions on four devices and nobody can say where they all are. At that point the club has lost the four things that actually constitute security: you cannot revoke an email attachment, you cannot log who opened or forwarded it, the copy is frozen while the real data has moved on, and you cannot delete what you cannot locate.
Where Your Data Is Stored
SquadSpot is hosted in Sydney, Australia. Member records, attendance, scores and documents stay onshore — they are not replicated to overseas data centres in the normal course of running the platform. Infrastructure is provided by DigitalOcean, operating from their Sydney region. Where your members' personal information physically resides is a question your committee may need to answer, particularly if your club is covered by the Privacy Act or expects to be. It is worth asking of any platform you are considering.
Access, Authentication and Oversight
Access scoped to the role
Administrators see what their role requires, not everything by default. A committee member handling renewals does not need the same access as the person managing licences, and SquadSpot reflects that.
Two-factor authentication and passkeys
SquadSpot supports two-factor authentication using an authenticator app, and passkeys for passwordless sign-in. The account holding your club's member data is not protected by a password alone.
Members manage their own records
Members view and update their own details through their own login. The secretary does not hold a separate list, and a correction does not require an email chain.
Encryption, Backups and Recovery
Data is encrypted in transit between your browser and SquadSpot, and at rest in storage. Backups run daily, so if something goes wrong — an accidental bulk deletion, a data error, a technical failure — your club's records can be restored rather than reconstructed from memory and paperwork. SquadSpot also runs automated testing, unit testing and security testing on an ongoing basis as part of development, rather than as a one-off exercise.
Your Data Belongs to Your Club
You can export your club's data at any time while you are a customer. If you leave SquadSpot, we retain your data for three months, during which you can download a full export — so a club changing systems is not forced to migrate under time pressure, and a committee handover does not accidentally cost you your records. Card payments are processed by Stripe; card numbers are never stored by SquadSpot and never touch our systems.
Supporting Your Club's Privacy Obligations
Whether the Privacy Act applies to your club depends on your circumstances — turnover, and whether you fall into a category captured regardless of turnover, such as clubs providing a health service and holding health information. If your club is covered, or chooses to work to the standard voluntarily, several of the Australian Privacy Principles are easier to meet when member data lives in one controlled system: APP 11 through encryption, access controls, audit logging and daily backups; APP 12 and 13 because members view and update their own records directly; and APP 8 because your data stays onshore. This is general information, not legal advice — if your committee needs certainty about its obligations, that is a conversation for your own adviser.
Frequently Asked Questions
Where is our club's data stored?
In Sydney, Australia, on infrastructure provided by DigitalOcean. Your member records, attendance and scores stay onshore rather than being replicated to overseas data centres.
Is our data encrypted?
Yes — in transit between your browser and SquadSpot, and at rest in storage.
Does SquadSpot support two-factor authentication?
Yes. SquadSpot supports two-factor authentication using an authenticator app, and passkeys for passwordless sign-in.
Who in our club can see member data?
Access is scoped to each administrator's role rather than granting full access by default. Members can see and update their own records through their own login.
What happens to our data if we leave SquadSpot?
We retain it for three months so you can download a full export. The window exists so a club changing systems is not migrating under time pressure.
How often is our data backed up?
Daily, with the ability to restore if something goes wrong.