Security

Data in transit

Every connection to BadgeReg (the organizer dashboard, the parent registration flow, and the API behind them) is served over HTTPS. Traffic between a family's browser and BadgeReg is encrypted, and requests that arrive over plain HTTP are redirected.

Passwords and sign-in

Passwords are hashed with bcrypt before they are stored. BadgeReg never keeps a readable copy of a password, which means nobody (including us) can look one up or email it back to you. A forgotten password is handled with a single-use, time-limited reset link rather than by recovering the old one.

Sessions are held in a cookie that JavaScript cannot read (httpOnly), that browsers will only return over HTTPS (Secure), and that is paired with a separate anti-forgery token on every state-changing request. Together those close off the two common ways a session gets stolen: script injection reading the token, and another site silently submitting a request as you.

Who can see what

BadgeReg has four levels of access, and each one is enforced on the server for every request rather than by hiding buttons in the interface:

• Parents see their own account and their own Scouts. They cannot see another family's registrations.
• Counselors see the roster and attendance for the classes they are assigned to, not the event's finances.
• Admins run the event: schedule, registrations, reporting, and the payment ledger.
• Owners additionally control event configuration and who else has access.

Separation between events

Each merit badge college is its own tenant with its own web address, and every record in the system is scoped to the event it belongs to. Queries are filtered by that scope on the server, so one unit's organizers cannot read another unit's Scouts, rosters, or payments even though both events run on the same platform.

The public demo is separated further still: it runs as its own instance against its own database, loaded only with invented sample data, and it is wiped and re-seeded on a schedule. No real event data exists in the environment prospective customers explore.

Payments and card details

Card details are entered on PayPal's own checkout and never pass through BadgeReg. We are not in a position to leak a card number because we never receive one.

What BadgeReg does store is the record of the transaction: the PayPal capture reference, the amount, the processing fee, and what it was for. That is what makes the ledger, receipts, and refunds work.

Sensitive information about Scouts

A merit badge college registration includes information that deserves care: a Scout's date of birth, and any allergies or health concerns a parent chooses to record so the event can be run safely.

That information is visible to the adults running the event who need it, and to the parent who entered it. It is not shared outside the event, it is not used for marketing, and it is never sold. Parents can edit or remove what they have entered, and an organizer can delete a registration outright.

Change tracking

Administrative actions are recorded to an audit log, so an organizer can answer questions like who moved a Scout between classes or who issued a refund. This matters most for the money: a fundraiser has to be accountable to the unit afterwards.

What BadgeReg does not have

We would rather you hear this from us than discover it later. BadgeReg is a small, volunteer-run operation, and the following are genuinely out of scope today:

• No SOC 2, ISO 27001, or comparable third-party audit, and no independent penetration test.
• No contractual uptime commitment or service level agreement. Availability is best effort.
• No guaranteed backup or recovery window. Export your roster and ledger at the end of your event (the export exists for exactly this reason), and keep your own copy of anything your unit needs for its records.
• No formal certification against children's-privacy frameworks, though the practices described on this page and in our privacy policy are written with Scouts' data specifically in mind.

Reporting a vulnerability

If you believe you have found a security problem in BadgeReg, please report it to support@badgereg.com rather than disclosing it publicly, and give us a reasonable chance to fix it. Tell us what you found and how to reproduce it. We will confirm receipt, keep you updated, and credit you if you would like to be credited. We will not pursue anyone acting in good faith to report a genuine issue.