Security and data
Built so nobody has to take anyone's word for it.
How PatronNow protects your account, your sponsors' details and the money that moves through it. Plain language, no claims we cannot stand behind.
Payments
Online payments are processed by Stripe, a regulated payment provider. Card and bank details are entered on Stripe's own pages and never reach PatronNow. Money settles directly to the club's Stripe account; we never hold it.
Accounts
Passwords are stored as one-way hashes. Sign-in, password reset and verification links are single-use and expire. Two-factor authentication is available, and is required for PatronNow's own operators.
Records
Accepted terms and issued invoices cannot be edited afterwards, by anyone. Significant actions are written to an audit history that shows who did what and when.
Access
Every page and action checks that you belong to the organisation and have the role for it. Links sent to sponsors are for the named recipient, expire, and can be revoked by the club.
Hosting and backups
The service runs on DigitalOcean, with a managed database backed up by the provider. Connections are encrypted throughout.
This website
This site sets no cookies, stores nothing in your browser, loads no third-party scripts and makes no external requests. The pilot form sends your message by email to our pilot inbox; the site does not keep a copy.
Reporting a vulnerability
If you find a security problem, tell us privately at security@patronnow.app before anyone else, and give us a reasonable time to fix it. We will not take action against good-faith research, and we will credit you if you want. Our security.txt carries the same contact.
Your data
What we collect, why, who processes it and how long we keep it is set out in the privacy policy. To ask for a copy of your data, correct it or have it deleted, email privacy@patronnow.app.