Prism
All documents

Security Overview

How Prism protects your club's data

Prism - April 2026 - Non-technical summary

Designed for committees who want reassurance, not technical specifications

This document explains the key security measures in plain language. It is intentionally non-technical - we do not publish configuration details that could assist an attacker. A full technical security audit is available on request for prospective partner organisations.

Infrastructure

Prism runs on professional cloud infrastructure with enterprise-grade physical security, redundant power, and 24/7 monitoring. Data is stored in managed, encrypted databases hosted within the United Kingdom. All infrastructure is maintained and updated regularly to address known security vulnerabilities.

Encryption

Data in transit

All communication between your browser (or phone) and Prism uses TLS 1.3 - the same encryption standard used by online banking. The padlock icon in your browser confirms this is active. No personal data is ever transmitted in an unencrypted form.

Data at rest

All data stored in the Prism database is encrypted at rest using industry-standard algorithms. Even in the unlikely event of physical access to storage hardware, the data cannot be read without the encryption keys.

Access controls

Prism uses a strict role-based access model. There are four permission levels:

  • Member: can only see their own entries, scores, and the club programme. Cannot see any other member's personal details.
  • Selection committee: can review image bank nominations for external competitions, but cannot manage members or access administrative functions.
  • Admin: can manage competitions, members, and club settings within their own club. Cannot access any other club's data.
  • Superuser: restricted to the platform operator. Each club's data is completely isolated from all others - there is no shared data between clubs.

Every club's data is siloed at the database level. An admin at Club A has no technical means of accessing Club B's data, even with maximum permissions.

Authentication

Two-factor authentication (2FA)

Two-factor authentication is available on every account and strongly recommended for administrators. Once it is switched on, signing in needs the password and a time-based code from an authenticator app on the account holder's own device, so a compromised password is not enough on its own.

Taking an authenticator off an account needs either a current code from it or a reset by a club administrator, and every reset is recorded in the club's audit log with who performed it. A club can see at any time which of its accounts have two-factor authentication enabled.

Password security

Prism uses an industry-standard authentication system. Passwords are never stored in plain text. Login attempts are rate-limited to prevent brute-force attacks.

Audit logging

Every significant administrative action in Prism is automatically recorded in a tamper-evident audit log: who made the change, what was changed, and when. This provides a complete trail for any investigation or dispute.

Data isolation

Prism is built as a multi-tenant platform. Every database row carries a club identifier and is protected by row-level security policies. Even if an application bug were to allow an unexpected query, the database layer independently enforces that each club can only see its own data.

Backups

Automated encrypted backups run on a scheduled basis. The backup policy provides:

  • Multiple recent snapshots retained for fast recovery from accidental deletion.
  • Daily backups retained for one month.
  • Weekly backups retained for two months.
  • Monthly backups retained indefinitely.

Backups include both the database and all uploaded image files. Recovery can be performed to any point in the retention window.

Competition night resilience

Prism is designed so that a competition can continue and all scores are preserved even in adverse conditions:

  • Every judge score is saved to the server immediately on entry.
  • If the connection drops, scores are queued locally and sync automatically when it returns.
  • An offline Venue Pack can be downloaded in advance for venues with unreliable internet.
  • The "Publish scores" step is protected: it cannot be triggered while any scores are still pending sync.

Data breach response

In the event of a suspected personal data breach, we will:

  1. Investigate and contain the incident immediately.
  2. Notify affected clubs within 24 hours of confirming the breach.
  3. Report to the Information Commissioner's Office (ICO) within 72 hours where required by UK GDPR.
  4. Provide a written summary of the incident, its scope, and remediation steps.

Contact

Security questions or concerns: prism@templeton-smith.com