Skip to content
Fairway
Security

What we do with your course's data.

Written for a superintendent and a city IT reviewer at the same time. No certifications we don't hold, no claims we can't demonstrate.

Last updated 15 August 2026

Passwords

Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations with a per-user random salt, using the platform's own WebCrypto implementation. We never store a password, never log one, and cannot recover one — a reset issues a new single-use token rather than revealing anything.

Setting a new password ends every existing session for that account, on every device, at once. Removing someone from a course does the same thing immediately.

Sessions

  • Session tokens are 256 bits of cryptographic randomness, stored in the database only as a SHA-256 hash — a database dump does not yield usable sessions.
  • The cookie is HttpOnly, SameSite=Lax and Secure in production, so it isn't readable from JavaScript and isn't sent cross-site.
  • Sessions expire after 30 days and expired rows are pruned nightly.
  • Reset tokens are hashed at rest, single-use, and expire in one hour. Invitation tokens expire in seven days.

Tenant isolation

Every record in Fairway is scoped to a course, and every query carries that scope — there is no code path that reads a table without it. Your crew, jobs, hours, machines and spray records are not visible to any other course on the platform, and the shared labor pool deliberately exposes only what a course chooses to post.

What we deliberately don't store

  • Card numbers. Payments go through Stripe; card data never touches our servers or database.
  • Continuous location. The time clock records one coordinate at the moment somebody presses the button — not a track through the day. It's a distance measurement, not surveillance.
  • Passwords in any recoverable form, and never in logs.
  • Anything we'd sell. There is no data-sharing arrangement, no benchmark product, and no advertising network involved.

Abuse and rate limiting

Sign-in, password reset, signup, public forms and AI calls are all rate limited per IP and per identifier. The limiter fails open on purpose: if the store backing it has a bad day, requests are allowed through rather than locking a whole course out of their own schedule at 5am. Public forms additionally use a honeypot field, a timing check and a content scorer — and spam is accepted with the same cheerful answer as anything else, then dropped, so a bot never learns which signal caught it.

Infrastructure

Fairway runs on Cloudflare Workers with D1 for relational data, KV for ephemeral state and R2 for uploads. That means the application runs at the network edge, data is encrypted at rest and in transit by the platform, and we operate no servers of our own to be misconfigured.

Your data leaving

A manager or owner can export everything their course has, as JSON, in one click, without contacting us. The export deliberately excludes password hashes, session tokens and invitation tokens — exporting secret material would be a security hole dressed up as a feature.

What we're not claiming
We don't hold SOC 2, ISO 27001 or PCI certification, and we're not going to imply otherwise on a marketing page. Card data is handled entirely by Stripe, who do hold those. If your city or club requires a formal security review, get in touch — we'll answer the questionnaire honestly, including the boxes we can't tick.

Reporting something

If you find a vulnerability, email us and we'll respond. We won't threaten anyone who reports a problem in good faith, and we'll credit you if you'd like us to.