Skip to content
SmartLinks

Security

Last updated November 7, 2026

What we do today to protect the data courses and golfers trust us with. We keep this page to what is actually in place.

Connections

  • Every page and API is served over HTTPS. Browsers are told to use HTTPS only (HSTS, 2 years).
  • Security headers on every response stop other sites from framing our pages, stop content type guessing, and limit what is sent in referrers.
  • Pages cannot use the camera, microphone or location.

Signing in

  • No passwords. Staff and admins sign in with a 6-digit code sent by text or email.
  • A code lasts 10 minutes, works once, and stops working after 5 wrong tries.
  • SmartLinks admin access is limited to a short list of named people.
  • Course staff only see their own course.

Payments

  • Card payments go through Stripe's hosted checkout. Card numbers never reach our servers or our database.
  • Payment notices from Stripe are checked against Stripe's signature before we act on them.

Keys and access

  • Passwords and keys for our vendors live in our hosting provider's encrypted settings, not in our code.
  • Messages from Twilio, Stripe and our email provider are checked against their signatures.
  • Scheduled jobs need a secret key to run.

Limits and alerts

  • Forms, sign-in codes and data requests are rate limited, per person and per network.
  • Errors on any page, scheduled job or browser send an alert to our team. Alerts leave out request bodies and stack traces, and scrub emails, phone numbers and keys from the message.
  • We store a one-way hash of part of a visitor's IP address, never the full address.

Backups

  • Our database provider takes daily snapshots and keeps them for 7 days.
  • A weekly export of our sales records (leads and customers) goes to a private storage bucket.

Privacy by default

  • Analytics and ad tags stay off until a visitor accepts cookies, and stay off when the browser sends Global Privacy Control.
  • Golfers and leads can ask us to delete their data from any of our sites, after proving the email or phone is theirs.
  • The companies that handle data for us are listed on our subprocessors page.

Report a problem

Found a security issue? Email josh@smartlinksgolf.com with the details. Please give us a chance to fix it before you share it. If a breach affects a course's data, we tell the course, and we tell affected people as the law requires.