Security and compliance

The PickleDeck database is hosted in the European Union (Dublin, Ireland) by Supabase on AWS infrastructure. The application is served by Vercel, which runs a global CDN under a data processing agreement that meets European requirements.

One question keeps coming up: “what is visible publicly, and what never is?”. Here is the explicit answer.

• HTTPS / TLS on all communication between your browser and our servers
• Encryption at rest of the databases (AES-256)
• HelloAsso tokens encrypted with AES-256-GCM
• DUPR tokens encrypted in the database and never read back by the application: column read access revoked, no decryption function
• Passwords hashed with bcrypt by Supabase Auth

• Row-level security policies (Row Level Security) on every sensitive table
• Column-level restrictions hiding email, phone and date of birth from unauthenticated access
• Tiered role system: owner > co-organiser > referee

• Server-side validation of every input with Zod
• HTTP security headers: HSTS for 2 years, CSP, X-Frame-Options DENY, Referrer-Policy
• Sensitive information hidden from unauthenticated users
• Unpredictable UUID v4 identifiers on every public resource (anti-enumeration, anti-scraping)
• Next.js CSRF protection on every Server Action
• Secure sessions: SameSite=Lax, Secure flag, configured lifetime
• Single-use tokens with explicit expiry (password reset, referee access links, magic links)

• Cookie consent banner via tarteaucitron.js
• Granular consents with timestamps
• Right to portability: JSON export of your data
• Right to erasure: anonymisation of your account
• Detailed privacy policy
• Record of processing activities compliant with GDPR Art. 30

For more details, see our privacy policy.

• Payments processed through HelloAsso (a long-standing French partner) and Stripe (PCI-DSS certified)
• No bank card data stored on our servers
• HMAC signature check on every webhook (HelloAsso and Stripe)

• Full traceability of sensitive actions (sign-ins, exports, deletions, changes)
• Logs kept for 1 year
• Replay protection on webhooks (deduplication)
• Rate limiting on authentication endpoints

Service continuity is a contractual commitment to our institutional customers. The parameters below are documented and auditable.

For institutional partnerships, a contractual SLA can be negotiated with quantified commitments on availability and response times.

Beyond the technical service continuity parameters above, PickleDeck formally commits to the long-term future of the platform and to protecting data in the event of a major event affecting the company.

• Notice before closing down: at least 30 days, with individual notification to every user
• Data recovery: 90 days after notification, a full JSON and CSV export that any customer can download at any time
• Source code escrow: on contractual request, the source code is deposited with a trusted third party (Lex Persona or Logitas), to be activated in Q2 2026
• Security incident procedure: contact security@pickledeck.com, with acknowledgement within 72 working hours (see responsible disclosure)
• Reversibility plan: a documented procedure for migrating to another provider, carried out in under 30 days

For full details of the continuity commitments, governance and trajectory of the company, see the continuity page.

Here is the list of subprocessors involved in processing your data, with their location and whether a data processing agreement (DPA) is in place:

Our infrastructure passes the main public security audits. You can check the results yourself by clicking the links below:

These audits are public and independent. Any customer, partner or auditor can run them again at any time.

In line with the obligations of article 30 of the GDPR and the accountability approach required by the regulation, we keep the following documents up to date. They are available on request from the supervisory authorities (CNIL) or our federation partners (FFT):

To get one of these documents, write to dpo@pickledeck.com.

Found a vulnerability? Contact us at security@pickledeck.com. We commit to acknowledging receipt within 72 working hours and not to take action against security researchers acting in good faith.

PickleDeck commits to answering, within reasonable timeframes, the security questionnaires, internal audits and document requests from sports federations, leagues, committees and partner institutions.

• Answers to standard security questionnaires (ANSSI, MIPS, ISO 27001 light) within 10 working days
• Provision of the DPA, the record of processing activities, the DPIAs and the recovery plans on official request
• Willingness to sign a mutual NDA before any sensitive information is shared
• On-site or video audits possible with a senior technical contact, as part of contractual partnerships

To start a federation audit, write to partenariats@pickledeck.com.