Security and reliability: how your show's data is protected

A car show hands its software three things it cannot easily get back: the entrant list, the results, and the show’s good name. Most organizers never ask how any of that is protected until a board member or a city partner asks them. This page is the answer, written to be forwarded.

Signing in

Organizer accounts sign in with a password, or with Google, Microsoft, Apple, or PayPal if your club prefers one less password to manage. Passwords are stored hashed, which means we hold a scrambled fingerprint of your password rather than the password itself.

Two-factor authentication is available for every organizer account: pair any authenticator app, and keep the single-use recovery codes somewhere safe for the day the phone goes missing. It is optional for organizers, and it is required for Car Show HQ’s own operators, because our access is wider than any one show and should be held to a higher bar than yours.

Registrants, spectators, and judges never create accounts at all, which is its own kind of security: credentials that do not exist cannot leak.

Whose data sits next to yours

Nobody’s. Every organization on the platform is isolated from every other one. Your staff see your shows, your entrants, and your results, and no path in the product crosses that line. The same isolation is why a compromised account at some other club is their bad day, not yours.

Money and card numbers

Card details are typed on your payment provider’s own checkout pages, run by Square, Stripe, or PayPal, and never reach our servers. We could not show you a card number if you asked. What comes back to Car Show HQ is payment status, the single fact that marks an entry paid.

The money itself settles in your club’s own account. Car Show HQ never holds funds, so there is no pile of your money sitting with us to worry about.

Results you can defend

Votes and judged scorecards are never edited in place. A revised score is a new record that supersedes the old one, and the old one is kept, so the tally can always show its work. When somebody questions a result at the trophy table, the difference between “trust us” and “here is the record” is the whole argument.

Sensitive actions in your show, like rotating a gate crew link, land in your show’s change log, so you can see what changed and when.

How changes ship

Every change to the platform runs through an automated test suite before it can deploy, and a change that fails its tests does not ship. After a deploy, the platform checks its own health; a release that fails that check rolls back to the previous version automatically rather than staying up broken.

We do not publish availability percentages, because a number without a contract behind it is decoration. What we can tell you is the shape of the system: tested releases, automatic rollback, and a platform whose busiest hours are Saturday mornings, built by someone who is standing at a show on those mornings too.

Backups

The database is backed up nightly, and backups are stored off the server that runs the platform. Losing a machine does not mean losing your shows. Your permanent show pages, results, and entrant history are part of that record.

What to do on your side

Three habits cover most of the risk a show can control. Turn on two-factor authentication for the owner account, since it can do the most. Give volunteers the crew link instead of a staff login, so a lost phone on show day exposes nothing that matters. And when a season ends, remove staff who no longer help run the show, the same way the treasurer’s key comes back at the end of a term.

Keep reading

• Check-in and cards
• Emailing registrants
• Gate Mode
• Gear & services
• Group entries
• Importing entrants
• Judged scoring
• The location check
• Payments and payouts
• Recurring shows
• Results and awards
• Roles and staff access
• Setting up registration
• Spectator donations
• Spectator voting
• Sponsor invoices
• Sponsors and tiers
• Testing your show
• Your own pages