Security
Club software security: how Bubs protects member, card and financial data
Card numbers go to Stripe, not to us. Staff see only what their role at your club allows. Money is recorded append-only, and your club's data exports in full whenever you ask.
What's at stake
What does club software have to protect?
A private club's system holds its members' names, families, phone numbers and spending, the club's receivables and its books. Members expect that information to stay inside the club, and the finance committee expects the numbers to be the ones that actually happened.
This page describes how Bubs is built to meet both expectations. It sticks to what the product does, so your club's reviewer can check each point in a demo.
Payment and payroll data
The most sensitive numbers never reach Bubs
Card numbers, bank accounts and Social Security numbers are collected by the specialists who process them. Bubs keeps references, not the numbers themselves.
Card numbers go to Stripe, not to Bubs
Members enter cards in Stripe's own payment sheet in the app, and staff take cards on Stripe Terminal smart readers — chip, tap or swipe. The card number goes straight to Stripe; Bubs keeps only a reference to it.
Bank details stay with the processor
For autopay by ACH, the bank account and the debit mandate are collected and held by Stripe. Bubs records that the member consented, not the account number.
Payroll details stay with Gusto
Employees enter Social Security and bank account numbers with Gusto directly. Bubs sends hours and tips; it doesn't collect either number.
Controls
How access, money and history are protected
The controls a finance committee or an auditor will ask about, built into how Bubs stores and serves data.
Access by role, scoped to the club
Every staff permission is a role at a specific club — owner, manager, controller, staff. A controller can reach the books and payroll without the tee sheet; shop staff can ring a sale without seeing the ledger.
Each club's data kept to itself
Every request is scoped to the club it belongs to. A member of one club cannot reach another club's roster, minutes or accounts — the request is refused before anything is looked up.
Sign-in without shared secrets
Members sign in with a one-time code sent to their phone or email, rate-limited by number and by network. Any password or register PIN is stored only as a salted scrypt hash.
Money that can't be quietly edited
Charges, payments and journal entries are append-only. A correction is a reversal recorded beside the original. The database refuses an unbalanced journal entry, and a closed month refuses new postings.
A history of who did what
Changes are written to an append-only history that records who made them and which property they touched. Voids need a manager and leave a record; staff-assisted account links name the staff member.
The club's data, exportable
Club administrators can export all of the club's data at any time. Sign-in credentials are never included in an export.
In transit
Encrypted between every app and the server
The member app, the staff apps, the registers and the console all talk to the Bubs API over HTTPS, with standard security headers on every response. Credentials Bubs holds for outside services are encrypted again at rest.
Questions
Reviewing Bubs for your club?
Send your security questionnaire to support@bubs.golf and it will be answered by the people who build the product.
FAQ
Security questions
Do card numbers touch Bubs servers?
No. Cards are entered in Stripe's own payment components or on Stripe Terminal readers and go directly to Stripe. Bubs stores a reference to the card, never the number.
Is data encrypted?
All traffic between the apps, the console and the Bubs API travels over HTTPS. Credentials Bubs holds for third-party services, such as the payroll connection, are additionally encrypted at rest with AES-256-GCM.
Who at the club can see member and financial data?
Only staff the club has granted a role, and only what that role allows. Roles are granted per club, and a group-level role applies only to the clubs in that group.
Can a transaction be deleted or edited after it's posted?
No. Money records are append-only. Refunds, voids and corrections are new records that reference the original, so the history always adds up and shows who made each change.
How are member accounts protected when a club switches to Bubs?
Imported accounts have no login until the member claims them with a one-time code sent to the phone or email already on the club's roster. Invitations contain no code or link that grants access.
Can we get all of our data out?
Yes. The club's administrators can export all of its data at any time in a documented, versioned format.
See your club on Bubs
Thirty minutes, your club's brand on the screen, and the parts of the day you care about most.