Trust & security
Your sponsor data, looked after
Zephlo holds commercial relationships worth real money to your club. Here's how that data is kept safe — in plain terms, no jargon.
One club can never see another's
Every club's data lives in its own space, enforced at the database itself with row-level security — not just hidden in the interface. There's no query that returns another club's sponsors.
Encrypted in transit and at rest
Traffic is served over HTTPS, and data is encrypted where it's stored. Nothing about your sponsors travels or sits in the clear.
Hosted in the EU
Your data is stored on infrastructure in the European Union, which keeps EU-based clubs on the right side of data-residency expectations.
Backups we've actually tested
We keep backups and have run a full restore drill — rebuilding the database from scratch — to prove we can bring your data back, not just that we're copying it.
Audited for the common attacks
The codebase has been through a full SQL-injection audit with zero findings, and access to every route is checked against who you are and which club you belong to.
The AI is on a short leash
AI features only read the data you've logged, run behind strict usage limits, and never train anyone's models on your information.
Who else touches your data
Zephlo runs on a small set of well-known services. Each one only sees what its job requires:
- SupabaseDatabase, authentication and file storage — EU region.
- VercelHosts the application and serves it over HTTPS.
- AnthropicProcesses text for the AI features. Does not train models on your data.
- Make.comDelivers notification and confirmation emails.
- CalendlyCall booking — only used if you book a call with us.
- Cloudflare TurnstileBot protection on forms. Sees the request, not your data.
That's the whole list. If it changes, this page changes.
Questions from your club's IT or a security questionnaire? Ask when you request access and we'll answer them straight. Read the privacy policy.