Server-side member isolation
A member cannot use the API to read another member’s account. Household access is limited to the configured primary relationship.
Security & data integrityTrust is not a badge.
Trust is not a badge.
It is how the system behaves.
Black Sparrow is built around operational controls that protect member boundaries, preserve financial history and make consequential actions accountable.
Current engineering controlsIntegrity at the
Integrity at the
data-model level.
These controls are implemented in the application today. Security reviews are answered with evidence from the configured deployment and the controls actually in operation.
Staff role enforcement
Member, staff, manager and administrative paths are separated, with authorization checks applied on protected endpoints.
Immutable POS source rows
Imported source transactions are not rewritten to hide corrections. Adjustments become distinct ledger entries with their own history.
Integer-cent money
All application money is stored and calculated as integer cents. Floating-point money paths are intentionally avoided.
Idempotent financial jobs
Imports, dues, minimum shortfalls, notifications and statements use unique operational keys so safe retries do not double-post.
Audited administrative action
Financial and administrative changes write audit history that can be reviewed in the staff console and reports.
Conflict-safe reservations
Database constraints protect tee-time and range capacity from concurrent double-booking, with explicit conflict responses.
Revocable digital credentials
Member QR credentials are opaque, revocable and checked against current membership status when scanned or opened.
Controlled reconciliation
Stripe and POS activity is reconciled back to the club ledger instead of being treated as a disconnected payment record.
Transparent postureWhat we claim.
What we claim.
What we do not.
Role enforcement, tenant and member isolation, audit logs, immutable source activity, integer-cent ledger, idempotent jobs, credential revocation and controlled exports.
Backups, hosting topology, retention, email delivery, processor configuration, operational monitoring and access ownership are configured for each environment.
Black Sparrow does not currently claim SOC 2 or ISO 27001 certification. We answer security reviews against the controls actually implemented.
Your requirements
Bring us the security questionnaire.
We will answer against the actual architecture, identify configuration decisions and document the controls in scope.
Start the conversation ↗