Information Security Policy

This policy covers the member portal, the club’s public website, and the vendor accounts through which either can be reached.

The portal administrator is accountable for information security and is the contact for any question or report: info@gtlions.org. The role belongs to the club, not to an individual, and passes with the office.

Who gets an account. There is no public sign-up. An account exists only for somebody on the club’s roster, added by a portal administrator. Sign-in is passwordless: a one-time code sent to the address the club already holds. Sign-in attempts are rate-limited and protected against automated abuse.

Least privilege. Everybody gets the least access their office requires, and no more. Ordinary members see the directory and the diary. Officers, the board and the finance committee may read the accounts. Only the treasurer may change them, and only the treasurer may see the club’s tax registration. Portal administration is a separate permission again, held by two people so the club is never locked out by one person’s absence.

Enforced by the database. These limits are row level security rules in the database, not conditions in the screens. Hiding a menu is a courtesy; every page re-checks, and the database refuses underneath. The most sensitive records — the banking connection credentials — carry no read policy at all and their privileges are revoked, so they are readable by no browser session under any account, including an administrator’s.

Granting and removing access. Only a portal administrator can create an account, change somebody’s role or grant administration. Access is removed when a person leaves the club or the office that required it — on the day, not at the next review. An administrator cannot remove their own administration or deactivate themselves, so the club cannot be left with nobody in charge by a single mistaken click.

Reviewed quarterly. A portal administrator checks every account against the roster at least once a quarter — that each still belongs to somebody in that role, and that nobody holds more than they need. The review is recorded in the portal with the date, who performed it, the counts at that moment and any changes made, so the club can show when it last looked rather than merely intending to.

Beyond the portal itself, club data is reachable through a small, listed set of vendor accounts — the hosting platform, the database, the code repository and the banking connection. Two-factor authentication is required on every one of them, and they are covered by the same quarterly review.

Administrative credentials are never shared between people and are never stored in the portal, in email, or in a shared document. Secrets used by the application are held by the hosting platform and are not present in the code repository.

All traffic is encrypted in transit (HTTPS, TLS 1.2 or better). All data is encrypted at rest by the database and file storage providers.

Member photographs and expense receipts are held in private storage and served only through short-lived links. Where a member’s internet address is recorded — for rate limiting — it is stored hashed, never in the clear.

Changes to records are logged by the database itself, including who made them and when, and that log cannot be edited by the application that writes it.

The club runs no servers and issues no laptops. The portal is hosted on managed platforms — Vercel and Supabase — which patch the operating systems, databases and network beneath it. There is no fleet of machines to scan, and the club does not claim to scan one.

What the club is responsible for is its own code and the software libraries it depends on. Those are monitored automatically for known vulnerabilities, and alerts are reviewed as they arrive.

Updates are applied on a defined timetable: anything rated critical or high within 7 days, everything else within 30 days. Where a fix is not available, the affected capability is switched off rather than left running.

Runtimes and platforms are kept on supported versions. Software approaching end of life is upgraded before it reaches it, not after.

The club connects its own bank accounts through Plaid in order to reconcile its books. This connection is read-only. The portal cannot move money, initiate a payment, or transfer funds, and it is not built to do so.

The club never sees or stores online banking credentials — those are entered directly with the bank through Plaid. Only a portal administrator can create or remove a connection. The resulting access token is held server-side and is unreadable by any signed-in session.

The club does not collect or store card numbers, bank account numbers, or Social Security numbers.

We do not sell, rent or trade information about members or supporters. We do not share it with anyone outside the club except the service providers needed to run the portal, and Lions Clubs International where membership reporting requires it.

Information is kept while it is needed for club business and for as long as the law requires financial records to be retained. Our Privacy Policy sets out the detail, and a member may ask for their information to be corrected or removed.

Suspected loss or misuse of information should be reported to info@gtlions.org immediately. The portal administrator will act to stop the exposure — revoking access, disconnecting a bank connection, or taking the portal offline if that is what it takes — and will inform the board and anybody affected.

Any bank connection can be disconnected by the club at once, without the co-operation of anyone else.

These practices were approved by the club’s board on June 3, 2026 and written up in this document on August 7, 2026.

The policy is reviewed at least once a year, and whenever the portal gains a capability that changes how information is handled.

Questions about this policy, or about how the club handles information, go to info@gtlions.org.