Security
How we protect your course and your golfers
A plain-language summary of how TeeMarshal is built to keep data separate, safe, and yours. No certifications are claimed here that we do not hold.
Your course is walled off from every other course
Every table in the database has row-level security turned on. A staff login can only read and write rows that belong to its own course, and that rule is enforced by the database itself, not just by the app. Automated tests check every table to confirm a user at one course cannot see or change anything at another.
Card numbers never touch our servers
Golfers type card details into fields served by Stripe, and in the pro shop cards are read by Stripe Terminal readers. We only ever see the card brand, last four digits, and payment status. That keeps TeeMarshal in the smallest PCI scope there is (SAQ A), and card numbers never appear in our database or logs.
You are the merchant of record
Payments go to your own Stripe account and Stripe pays out to your bank. We do not hold your money at any point.
Backups and recovery
The production database has point-in-time recovery turned on, so it can be restored to a specific moment. Every week an automated drill restores a backup to a fresh copy and runs checks against it, so we know the backups work before we need them.
Texting and email consent
The consent wording at checkout is fixed. Every opt-in, opt-out, and HELP request is written to a log that cannot be edited. STOP is honored on the very next message. Quiet hours are enforced. Every marketing email has a one-click unsubscribe and your physical address in the footer.
Export and deletion
You can export everything as CSV files from settings at any time. Deleting a golfer anonymizes their name, email, and phone while keeping the financial rows your books need. If you cancel, your data stays available for export for 30 days.
Access and application security
- Staff sign in with an emailed magic link or Google. There are no shared passwords to leak.
- Five roles (owner, manager, staff, starter, read-only) so people only get the access their job needs.
- Prices are always calculated on the server at booking time. A price sent by a browser is never trusted.
- The booking site works out which course it is serving from the web address, never from anything the browser sends.
- Privileged database credentials live only in server code, and an automated check on every build confirms they are not shipped to browsers.
- Incoming webhooks from Stripe, Twilio, and Resend are verified by signature before they are processed.
- Checkout, login, and API endpoints are rate limited per IP address, per phone number, and per API key.
- API keys are stored hashed and can be revoked at any time. Webhooks we send you are signed so you can verify them.
Records and monitoring
- Every booking, move, cancellation, refund, and rate change is written to an audit log with who did it and what changed.
- If our support team needs to look at your account, access is read-only and each session is recorded in your audit log.
- Errors and performance are monitored around the clock, with alerts to an on-call engineer for checkout failures, slow bookings, and messaging or payment problems.
- Data is encrypted in transit and at rest.
- Internal service credentials are rotated quarterly.
- AI providers are not permitted to train on your data, and the phone agent can only quote prices and times that come from your tee sheet.
How long we keep things
Defaults while you are a customer. Golfer records and bookings are kept until you delete them or close your account.
| Data | Kept for |
|---|---|
| Email and text message content | 13 months |
| Phone agent call transcripts | 90 days (you can change this) |
| Audit log | 7 years |
| Deleted golfers | Name, email, and phone anonymized. Financial rows kept. |
| Your data after cancellation | Available for export for 30 days, then deleted |
Status and incidents
We publish uptime and incidents for the booking engine, admin app, payments, messaging, and phone agent.
Report a vulnerability
If you believe you have found a security problem in TeeMarshal, write to security@teemarshal.com with the steps to reproduce it. We will acknowledge your report within two business days. Please do not access data that is not yours and give us reasonable time to fix the issue before sharing it publicly.
Questions from your IT person or your city?
We are glad to answer a security questionnaire or walk your team through how the system is built.