Security

Checked against the live system on 28 October 2026.

This page says how renuzy keeps your club's records safe today. Each line was checked against the system itself, not against a plan. What we commit to in writing is in our terms, and what we do with information is in our privacy notice.

What renuzy keeps

Whatever your club chooses to keep about its members. Typically that is names, email addresses, phone numbers and postal addresses, with membership type, status and renewal dates. It also holds what each person paid, when and how, and the last four digits of a card. Then there are photos members add, whether each person agreed to emails, and any note an officer writes.

renuzy asks for no health, religious or other sensitive details. An officer can type anything into a note, though, so write notes as if the member might one day read them.

How cards are handled

Members pay on Stripe's own checkout page, into your club's own Stripe account. The card number goes from their screen to Stripe. renuzy gets back that a payment happened, the amount, the date and the last four digits.

When a member chooses to renew automatically, Stripe keeps the saved card and renuzy asks Stripe to charge it. We hold Stripe's reference to the card, never the card itself. renuzy never holds your club's money either: it goes straight to your Stripe account.

Where it is kept

• Your club's records and files are stored by Cloudflare in its Western North America region.
• A second copy of your club's files is kept by Cloudflare in its Eastern North America region.
• The nightly backup copy outside Cloudflare is kept by Backblaze in its US East region.

Cloudflare encrypts the database and stored files with AES 256, according to Cloudflare's own documentation. Every page of renuzy.com and the renuzy app is served over HTTPS, so what travels between your screen and us is encrypted too.

Who can see it

Your officers, each with their own sign in and one of four roles:

• Owner: everything, including who else has access.
• Treasurer: the members and the money.
• Admin: the members, but not the money.
• Viewer: can look and change nothing.

An officer who steps down can keep look only access for a handover period, and then it ends. Notes about a member are shown to officers only, never to members.

Each member sees only their own record. They can change their own preferred name, phone and address. They cannot change their email or their name from that page. They can never mark themselves as paid: if they tell you they paid, it waits for your treasurer to approve.

Another club cannot see yours. Every officer page is tested on every change to the code, to prove that one club cannot open another club's records.

People at renuzy. Our back office shows each club's name, plan, member counts, officers, help requests and change history. It does not show your member list, and it has no way to sign in as one of your officers. Each time someone opens a club's page there, it is written to our own log. Signing in to the back office takes an email link, a passkey and a six digit passcode, and five wrong passcodes lock it for 30 minutes. A bookkeeping role sees our own expenses and nothing about any club.

The database itself can be reached directly only through renuzy's own Cloudflare account. Jeremiah Luttrell, who runs renuzy, holds that account, and our automated backup jobs use keys from it.

Signing in

• Officers get a sign in link by email. It works once and stops working after 15 minutes. Signing in cancels any older link still waiting in your inbox, and you stay signed in on that device for up to 12 hours. An address can ask for at most five links in 15 minutes.
• Members get a personal link in their club's emails. The link to their own page works for 7 days. Once opened, that device remembers them for up to 90 days, for that one club only.

We keep only a scrambled fingerprint of each link, so even a copy of our database holds no link that works.

The change history

Every officer can open the page called What changed, and who changed it. It lists changes to your records and settings with who made each one and when, and every download of your member list or payments is on it. No screen in renuzy, ours included, can edit an entry. It is kept for as long as your club is on renuzy.

When a member is erased at your request, their name and details are blanked in the history too, so the record of what happened stays without the person in it.

Backups

• Every night the database is backed up twice, by two different pieces of code, into Cloudflare's storage.
• One of those backups is loaded into a fresh database the same night, and its member count is compared with the live one.
• That backup is also copied to Backblaze and locked for 35 days. Until the lock ends, nobody can delete or change it, us included.
• On the 6th of each month, the other backup is restored into an empty database and checked.
• Cloudflare also keeps its own history of the database, which can wind it back to any point in the last 30 days.
• Your club's files are copied to a second Cloudflare store every day, and to Backblaze every night.

Database backup copies are removed 36 or 37 days after they are made, and a deleted file leaves the file copies within 37 days. If a nightly backup fails, an alert email goes to Jeremiah as soon as it does.

Keeping watch

An outside check asks the renuzy app whether it is answering every hour, and alerts us when it is not. An error on any page is emailed to us as it happens.

When you leave

Your officers can download your club's records as spreadsheets at any time: members, payments, notes, the ledger, giving, events, volunteer hours and email history. A viewer cannot download the member list.

If you cancel, renuzy keeps working to the end of the time you paid for. Then you have 90 days to download what you need. After that your club's records and files are deleted from the live system, and they leave the backups as those age out, within 37 days. What we keep is a note that the deletion happened, with no member, address or money in it. You can ask us to delete sooner.

If your club is a chapter of a larger body, that body keeps its own record of what your chapter reported and paid to it.

To remove one member for good, your club's owner or treasurer asks us, and we erase them. Their name, contact details, notes and photos go. The amounts and dates your books need stay, under "Erased member".

Who we use

These companies handle your club's member information for us, and each one gets only what its job needs:

• Cloudflare runs the site and the app, and stores your club's records and files.
• Stripe takes payments into your club's own Stripe account and holds the card details. It also takes renuzy's own subscription payment.
• Resend sends the email renuzy sends for your club, so it receives each member's address and the message.
• Backblaze holds the locked nightly backup copy outside Cloudflare.
• Anthropic, or Amazon Bedrock running the same model on our own account, runs the features that read a file, summarise notes or draft text. It receives the records each of those needs. Your club's owner or treasurer can switch these features off, and then nothing about your club is sent.

What renuzy does not have

renuzy does not hold a SOC 2 report or an ISO certification, and no outside firm has run a penetration test on it. Those audits are built for buyers with a procurement team, and we would rather spend the effort on the practices above. If your club has a security questionnaire, send it to [email protected].

Report a problem

If you think you have found a security problem in renuzy, write to [email protected] with what you found and how to see it. Please do not open, change or download anyone else's records while you look.

What we promise in writing

This page describes how things work today. The promises renuzy makes, and the limits on them, are in our Terms of Service, the Data Processing Agreement inside them, and our privacy notice. If this page and those ever differ, those govern.

Free spreadsheets, checklists and templates for club treasurers: free resources.