Security
Last updated: 8 September 2026
Access control
Every record in ProScout belongs to a single club workspace. Users can only read and write data inside their own workspace, enforced at the database layer rather than only in the interface. Roles (owner, admin, scout) determine what a user can do, and sensitive records such as injury history are limited to owners and admins.
Data in transit and at rest
All traffic to ProScout is served over HTTPS. Uploaded media and club branding are stored in private buckets and are only reachable through short-lived signed links generated for authorised users.
Audit logging
Creating, updating and deleting players, reports, shortlists and club settings is recorded in an append-only audit log with the acting user and timestamp. Data export and erasure requests are recorded separately.
Public share links
A player passport is private by default. When a club chooses to share one, only biography details and averaged ratings are exposed — never scout notes, contact details, injury history or internal comments. Share links can be switched off or given an expiry date at any time.
Reporting a vulnerability
If you believe you have found a security issue, please contact Pro Scout Data through the support channel shown inside the app with steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to fix it, and do not access, modify or delete data belonging to other users while testing.
Shared responsibility
Clubs are responsible for who they invite into their workspace, for keeping credentials confidential, for the lawful basis of the player data they upload, and for switching off share links they no longer need.