UK-hosted operations
Primary application and operational database infrastructure is located in the United Kingdom, with Cloudflare providing connectivity and network-level protection.
How hosting works
Security and data protection
Your club's data deserves proper protection.
Swimming clubs rely on accurate, secure information to manage their members, volunteers, competitions and day-to-day operations.
SwimNexus provides specialist management software for swimming clubs and competition organisers. We design for data protection, controlled access and clear operational responsibilities, so clubs can manage their information responsibly while maintaining control over who can access it.
A clear picture
Security is more than a setting.
Protecting club information depends on how the platform is hosted, how records are separated, who can reach them and how they can be recovered. These are the controls behind SwimClubOS today.
Separate club databases
SwimClubOS uses separate operational databases and private storage for individual clubs, helping prevent one customer reaching another's records.
How records are separatedControlled, role-based access
Clubs assign permissions for administrators, committee members, coaches, team managers, volunteers and families. Access follows a person's role and relationship with the club.
How access is controlledEncrypted, tested backups
Automated backup files are encrypted before upload to Microsoft OneDrive and Google Drive. Recovery from cloud backups has been successfully tested.
How recovery works
Hosting and infrastructure
Where your data is hosted
SwimNexus operates its primary application and database infrastructure in the United Kingdom. The platform runs on Windows server infrastructure using Apache/PHP and MariaDB.
We use Cloudflare Tunnel to securely connect the hosting infrastructure to Cloudflare's global network. This encrypted connection lets the website operate without publicly exposing the hosting server's inbound application ports.
Cloudflare provides connectivity and network-level security services, including traffic processing and edge protections. Cloudflare may process technical information such as IP addresses, HTTP traffic and security events. We do not claim that it stores no personal data or that it cannot inspect application traffic.
SwimNexus's operational databases and application files remain on SwimNexus-controlled infrastructure. Cloudflare Tunnel is not our primary database or file-storage service, and the primary databases are not hosted in Cloudflare D1, R2 or Workers.
Cloudflare's network is global. The location of SwimNexus's primary infrastructure should not be read as a promise that every technical service stays within the United Kingdom.
Visitor connectionHTTPS/TLS to the public website.
Cloudflare networkTraffic processing and network-level protections.
SwimNexus infrastructureUK-hosted Windows, Apache/PHP and MariaDB.
Diagram simplified. It does not show internal network details or public server ports.
Customer separation
Your club's information stays separate.
SwimClubOS is built as a multi-tenant platform. Each club's operational records are kept apart through separate infrastructure boundaries and controlled access.
Separate operational database
Each provisioned SwimClubOS customer is resolved to its own database, with tenant-specific credentials and configuration.
Separate private file storage
Club files and private documents use the customer's storage boundary rather than a shared, unscoped upload area.
Tenant-specific configuration
Club identity, settings and public-site details are resolved for that tenant. An unknown or incomplete tenant fails closed.
Controlled user permissions
Administration and family access are limited to authorised users. Public pages expose only deliberately published information.
This approach helps keep each organisation's membership records, financial information and other operational data separate from those belonging to other customers.
Separation reduces the risk of cross-club access; it is not a claim that a breach is impossible. SwimMeetOS meets are scoped to the host organisation within the platform and are not described as separate per-host databases.
Access control
Access controlled by your club.
SwimClubOS uses authentication and role-based permissions to control access to club information. Clubs can assign access appropriate to each person's responsibilities, helping ensure that sensitive information is available only to authorised users.
Staff roles start with a permission preset that can then be adjusted feature by feature. Family Portal access follows linked swimmers and households rather than granting a general view of the club.
The permission model is designed around responsibilities such as:
- Club administrators
- Committee members
- Coaches and welfare officers
- Team and membership secretaries
- Volunteers and fundraisers
- Parents, guardians and swimmers
What the club manages
- Assigning roles appropriate to each responsibility
- Reviewing permissions as club work changes
- Removing access promptly when responsibilities end
- Protecting individual account credentials
- Deciding what information is published publicly
About multi-factor authentication
Multi-factor authentication protects the Microsoft and Google backup-storage accounts. It is not currently enforced for every SwimClubOS or platform user account, and this page does not suggest otherwise.
Encryption and secure connections
Encryption and secure connections.
Encryption protects information as it moves between services and adds a further layer to encrypted backups. These protections work alongside access control; they do not replace it.
HTTPS/TLS
Public website connections use HTTPS/TLS. TLS protects the connection through each hop; it is not a claim of a single end-to-end encrypted session directly between the visitor and the Windows origin.
Cloudflare Tunnel
The tunnel carries traffic over an encrypted connection between the hosting infrastructure and Cloudflare's network, without publishing the origin's inbound application ports.
Locally encrypted backups
SwimNexus encrypts backup files locally before they leave the hosting PC. Microsoft OneDrive and Google Drive then provide encryption in transit and at rest for those copies.
We do not currently claim that every operational database field or the live hosting disks are independently encrypted. The confirmed encryption described here applies to website and tunnel connections and to the backup files.
Backups and disaster recovery
Backups and disaster recovery.
SwimNexus maintains automated encrypted backups to support recovery in the event of data loss or system failure.
Backup files are encrypted before leaving our hosting infrastructure and are stored using Microsoft and Google cloud services. Both cloud-storage accounts are protected by multi-factor authentication.
Our backup and recovery process has been tested, including successful restoration of data from cloud backups.
These controls were confirmed by the system operator. They are not an independent certification, an availability guarantee or a fixed recovery time.
- 1Automated backup
Backups run automatically to support recovery from data loss or system failure.
- 2Encrypt before upload
Files are encrypted locally before they leave the hosting PC.
- 3Protected cloud copies
Copies upload to Microsoft OneDrive and Google Drive, which provide encryption in transit and at rest.
- 4Account protection
Both cloud-storage accounts are protected by multi-factor authentication.
- 5Tested recovery
Data has been successfully restored from cloud backups, with copies recoverable for up to 30 days after deletion.
Backup locations, encryption key-management details and internal recovery procedures are not published here.
Privacy and children's information
Data protection and privacy.
SwimNexus and the clubs that use it have different responsibilities for personal information. Understanding that split helps a club answer questions from its members and families.
The swimming club
The club determines why member information is collected, how it is used and what is published. It is normally responsible for its privacy notices, lawful bases and member requests.
SwimNexus for club records
SwimNexus processes club information to provide the contracted software services and acts in accordance with the applicable processing arrangements and the club's documented instructions.
SwimNexus for its own records
SwimNexus may separately control information about its accounts, business relationships, support enquiries, security and service administration.
Information clubs may hold
The system can hold information associated with adult swimmers, children, parents and guardians, coaches, volunteers and club officials. Depending on how a club uses SwimClubOS, this may include contact details, membership records, medical information, attendance, financial information, competition entries and performance records.
Clubs should collect only what they need and handle children's and health information with particular care. A Data Processing Agreement supports the contractual relationship; it is not consent from every club member.
Privacy questions
Customer organisations are provided with data-processing agreements covering their use of SwimNexus services. Clubs can ask us for the current processing, security and subprocessor schedules.
For a privacy question about your own information, start with the club that holds your records. If you need SwimNexus's help or have a question about our own processing, contact [email protected].
SwimNexus aims to handle information in line with applicable UK data-protection law. This page explains the controls and responsibilities in place; it is not a legal opinion or an unqualified certification of compliance.
Third-party services
Selected providers, clearly described.
SwimNexus uses selected external providers to support hosting, connectivity, backup and service communication. Their roles are narrower than “everything the platform does”.
SwimNexus-controlled services and integrations chosen by a club are different arrangements. A club's own payment provider, Microsoft 365 account or email service is not automatically a SwimNexus subprocessor.
The contractual subprocessor schedule is the authoritative list for a customer agreement. It identifies which suppliers are approved for club personal data and which are pending or club-controlled.
Ask for the current processing schedules| Provider | Role in the service |
|---|---|
| Cloudflare | Website connectivity, traffic processing and network-level security. It is not the primary database or file-storage service. |
| Microsoft OneDrive | Encrypted backup storage. Microsoft provides encryption in transit and at rest. |
| Google Drive | Encrypted backup storage. Google provides encryption in transit and at rest. |
| mailbox.org | SMTP delivery of SwimNexus service email, such as account and onboarding messages. |
A provider named on this page is not necessarily a subprocessor for every category of club data. Club-connected integrations remain the club's arrangement unless the contractual schedule says otherwise.
Independent security assurance
Clear about what we have proved.
SwimNexus is independently developed and operated.
Our security arrangements include customer data separation, controlled application access, encrypted offsite backups and tested recovery procedures.
We do not currently hold ISO 27001 or Cyber Essentials certification, and we have not yet commissioned an independent application penetration test.
We are committed to maintaining and improving our security arrangements as the platform develops.
Current assurance position
- ISO 27001Not currently held
- Cyber EssentialsNot currently held
- Independent penetration testNot yet commissioned for the complete application
- Recovery testingSuccessful restoration from cloud backups confirmed by the system operator
Cloudflare, Microsoft and Google operate their own security programmes. Their certifications do not certify SwimNexus.
Security information for clubs
Documentation for your due diligence.
Prospective and existing customer organisations can request further information about the platform's security and privacy measures. We will share what is relevant and available, subject to appropriate confidentiality.
Security assurance summary
This page records the current controls, verification position and known limitations.
Data Processing Agreement
The controller and processor terms for a customer organisation.
Technical and organisational measures
The controls in place and those still unverified.
Processing schedules
Data categories, purposes, people and controller responsibilities.
Subprocessor information
Approved providers, their roles and the status of any candidates.
Retention, export and exit
How club data is exported and what happens at the end of service.
Availability depends on the current agreement and the organisation's access. Internal security procedures and confidential infrastructure details are not published.
Security questions and vulnerability reporting
Questions about security?
Contact us about a suspected vulnerability, a security incident, a privacy concern, data processing or a request for security documentation. Reports will be reviewed and handled appropriately.
Use the subject line Security Report – SwimNexus when reporting a suspected vulnerability. Please avoid including passwords, encryption keys or unnecessary personal information.
Questions clubs ask
Security, in plain terms.
How is club information separated?
Each SwimClubOS customer is resolved to its own operational database and private storage, with tenant-specific configuration and controlled user permissions. This helps keep club records separate and limits access to the people authorised for that club.
Is data encrypted in transit and at rest?
Public website connections use HTTPS/TLS, and Cloudflare Tunnel carries traffic over an encrypted connection to the hosting infrastructure. SwimNexus encrypts backup files locally before they are uploaded to Microsoft OneDrive and Google Drive, which also provide encryption in transit and at rest. We do not claim that every live database field or hosting disk is independently encrypted.
Can a club control who sees its information?
Yes. SwimClubOS uses individual accounts and role-based feature permissions. Clubs assign access according to each person’s responsibilities and can adjust permissions when those responsibilities change. The club remains responsible for keeping roles accurate and protecting account credentials.
What happens if data is lost?
SwimNexus maintains automated encrypted backups to support recovery. Backup files are encrypted before leaving the hosting infrastructure, both cloud-storage accounts use multi-factor authentication, and data has been successfully restored from cloud backups. These are operator-confirmed controls, not a guarantee of uninterrupted service or a fixed recovery time.
Does SwimNexus hold a security certification?
Not currently. SwimNexus does not hold ISO 27001 or Cyber Essentials certification, and an independent penetration test of the complete SwimClubOS application has not yet been commissioned. We describe the controls we operate without implying external accreditation.
Start with a conversation
Bring your security questions to the conversation.
We can explain the controls behind SwimClubOS, the current assurance position and the data arrangements to agree before your club moves live.
SwimNexus is still in testing. Clubs and meet hosts who help us test can get reduced pricing. Use the contact form to ask.