Security at Morrie

Where your data lives

• The Morrie app runs on Vercel from Sydney.
• The database, sign-in and stored files are on Supabase, a managed Postgres service.
• Everything travels encrypted (HTTPS) between your browser, Morrie and the services below, and the database and file storage are encrypted at rest.

Who can see what

• Each club's data is walled off from every other club's by row-level security in the database itself — on every table, not just in the app. An automated test checks that someone who isn't signed in can read none of it, including contacts, incident reports, working-with-children checks and sponsors.
• Inside a club, people are given a role (admin, editor and so on) that sets what they can see and change.
• Every account can turn on two-factor sign-in with an authenticator app, from its Account page.
• Personal links — a player's report, a fantasy team, a sponsor's portal — are long random codes, and each shows only that one thing.

Children and sensitive information

• Photos of working-with-children cards are deleted automatically after 14 days; only the expiry date read from them is kept.
• A player whose photo consent is declined doesn't have their photo shown, even to someone with the link.
• Incident reports and injury details are never public and sit behind the same database walls as everything else.
• Visitors' IP addresses are scrambled (hashed) before they're stored, never kept as they are.

Payments

Payments go through Stripe. Card numbers are entered on Stripe's own forms and never reach Morrie's servers or database.

Backups and getting your data out

• The database is backed up daily by Supabase.
• A club can also send a full backup of its own data to its own Dropbox each month.
• A club admin can download a full export of the club's data at any time, from Club settings — it's your data, and you can take it with you.

AI features

Morrie's AI features use Anthropic's Claude through its commercial API. Only what a feature needs is sent — the scorecard page being read, the meeting being minuted — and under Anthropic's commercial terms it isn't used to train their models. Every club has a monthly AI spending limit, and so does Morrie as a whole.

Keeping it running safely

• Errors are tracked and alert us straight away.
• Public forms and links are rate-limited against abuse, and sign-in has its own limits on repeated attempts.
• Background jobs only run with a secret key, and messages from outside services are checked for their signature before anything is done with them.
• No passwords or keys are kept in Morrie's source code.

The services that handle your data

Morrie uses these established services to do its job. Most only see a club's data when the club switches the feature on.

Privacy law

Morrie follows the Australian Privacy Principles under the Privacy Act 1988. If personal information is ever involved in a data breach likely to cause serious harm, we tell the clubs and people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. To have your personal information corrected or deleted, ask your club, or email us. More in our Privacy Policy.

Found a problem?

If you think you've found a security weakness in Morrie, email support@morrie.io with “Security” in the subject. Please give us a chance to fix it before telling anyone else, and don't look at or change other people's data while checking. We'll reply within two business days.