Security

Identity and access

• Accounts must authenticate before reaching signed-in club portals.
• Access is scoped by club and by role, including admin, coach, parent and player roles.
• Database row-level access policies add protection beneath the application interface.
• Password reset links use the managed authentication service and expire.
• Higher-privilege service credentials are kept out of browser-delivered code.

Data and infrastructure

• Connections use HTTPS encryption in transit.
• Club data is held in managed database infrastructure with provider access controls.
• Logical club separation is applied throughout product queries and database policies.
• Managed hosting and database providers maintain underlying physical and platform controls.
• Backups and recovery copies remain subject to provider and service access controls.

Application and operational security

• Dependencies and platform updates are reviewed as the service evolves.
• Operational logs are used for reliability, diagnostics and security, not advertising.
• Server operations validate identity and permissions rather than relying only on what the interface displays.
• Personal data is minimised where practical, particularly for junior eligibility.
• Security defects are prioritised according to likely impact and exploitability.

Incident response

CricketRight investigates suspected unauthorised access, contains affected systems, preserves useful evidence, fixes the underlying issue and assesses notification duties. Where CricketRight processes data for a club, it will notify that club without undue delay after becoming aware of a personal-data breach affecting the club's information.

What clubs and users should do

• Use a strong password that is not reused on another service.
• Keep email accounts secure because they can receive reset links.
• Sign out on shared devices and do not forward private team-sheet links unnecessarily.
• Review roles regularly and remove access when somebody leaves or changes responsibility.
• Report unexpected access, messages or account activity promptly.

Report a security issue

Use the contact form and choose Security report. Include the affected URL, what you observed, safe reproduction steps and your contact details. Do not access data that is not yours, disrupt the service or publish exploit details while the issue is being investigated.

CricketRight will acknowledge and triage a responsible report as soon as reasonably practicable. Privacy and safeguarding concerns should use the routes described on Privacy and Safeguarding.