Security Policy

Last Updated: Effective Date: December 27, 2025

Ballistic Club takes the security of our platform, our users, and compliance with firearms regulations extremely seriously. This policy outlines our security measures, reporting procedures, and legal obligations.

Overview

As a platform dedicated to shooting sports, hunting, and firearms collecting, we maintain the highest standards of security and compliance across Switzerland, the EU, and internationally.

Vulnerability Reporting

Contact

For security reports, please contact:

security@ballistic.club

Response Time: Within 48 hours

Reporting Guidelines

  • Provide detailed steps to reproduce
  • Include proof-of-concept if applicable
  • Allow us 90 days to fix before public disclosure
  • Do not access or modify user data
  • Do not perform destructive testing
  • Do not perform DoS/DDoS attacks
  • Act in good faith

Response Timelines

Initial Response: Within 48 hours

Status Update: Within 7 days

Scope

In Scope

  • • ballistic.club (main application)
  • • All subdomains (*.ballistic.club)
  • • API endpoints (/api/*)
  • • Authentication systems
  • • Data storage and processing

Out of Scope

  • • Third-party services (Supabase, Netlify, BunnyCDN)
  • • Social engineering attacks
  • • Physical security
  • • DoS/DDoS attacks
  • • Automated scanning without prior approval
  • • Vulnerabilities requiring physical access

Security Measures

We implement industry-leading security practices:

Encryption

  • • Data in Transit: TLS 1.3 (HTTPS enforced via HSTS)
  • • Data at Rest: AES-256 encryption for sensitive data
  • • End-to-end encryption for private messages

Database Security

  • • securityPolicy.sections.measures.database.transit
  • • securityPolicy.sections.measures.database.rest
  • • securityPolicy.sections.measures.database.endToEnd
  • • Row Level Security (RLS) on all tables
  • • User-level access controls
  • • Audit trails for all transactions
  • • Encrypted daily backups with point-in-time recovery

Application Security

  • • securityPolicy.sections.measures.application.transit
  • • securityPolicy.sections.measures.application.rest
  • • securityPolicy.sections.measures.application.endToEnd
  • • Content Security Policy (CSP) to prevent XSS
  • • Cross-Origin policies
  • • Input validation and sanitization
  • • Rate limiting on API endpoints
  • • Multi-factor authentication (available)

Monitoring & Response

  • • securityPolicy.sections.measures.monitoring.transit
  • • securityPolicy.sections.measures.monitoring.rest
  • • securityPolicy.sections.measures.monitoring.endToEnd
  • • Comprehensive security logging
  • • Real-time security alerts
  • • Regular vulnerability scanning
  • • Automated security updates for dependencies

Data Protection (GDPR Compliance)

As a Switzerland-based platform serving EU citizens, we comply with GDPR and Swiss Federal Data Protection Act (FADP):

Your Rights

Right to access your data
Right to rectification of inaccurate data
Right to erasure (within 30 days)
Right to data portability
Right to object to processing
Right to lodge complaint with supervisory authority

Data Breach Notification

  • • Supervisory authority notified within 72 hours
  • • Affected users notified without undue delay
  • • Full documentation of all incidents

Age Verification

All users must be at least 18 years old to create an account.

  • Age is confirmed during account creation
  • Future firearms-related features will require additional verification

Third-Party Security

We partner with trusted, compliant providers:

Supabase (Database & Auth)
  • • SOC 2 Type II certified
  • • GDPR compliant
  • • Encryption at rest and in transit
  • • EU region hosting available
Netlify (Hosting)
  • • SOC 2 Type II certified
  • • DDoS protection included
  • • Global CDN with security rules
  • • Automatic SSL/TLS
BunnyCDN (Media & Streaming)
  • • GDPR compliant
  • • Encrypted storage
  • • Access control rules
  • • EU data centers available

Contact & Further Information

Security

security@ballistic.club

Privacy

privacy@ballistic.club

Legal

legal@ballistic.club

General

info@ballistic.club

We respond to all security-related inquiries within 48 hours.

Policy Updates

Users will be notified of material changes to this policy via email.

    Ballistic.club - Die Schiesssport-Community der Schweiz