Security

PCI Compliant

WhyNotGolf complies with PCI-DSS 3.1 Level 1 as both a Merchant and a Service Provider.

• Registered with both Visa and MasterCard as a PCI-compliant Service Provider.
• Regularly audited by a Qualified Security Assessor (Coalfire, Inc.)
• Passes internal and external application and network penetration testing performed by independent security firms.
• Scanned daily by an Approved Scanning Vendor (ASV)
• PCI Attestation of Compliance (AOC) and Quarterly Scan Attestation of Compliance are both available upon request.
• WhyNotGolf employs a cross-functional team responsible for oversight of PCI Compliance.

Privacy

WhyNotGolf maintains a comprehensive privacy program. To us, this means that although we are required by law or regulation to do certain things, we are continually evaluating whether we can and should do more.

• We do not sell the personal information of our customers to third parties.
• We have a full time legal and security team focused on privacy and security issues.
• We participate in and comply with the EU-U.S. Privacy Shield Framework. You can find out more about our commitment to the EU-U.S. Privacy Shield Framework in our EU-US Privacy Shield Notice.
• You can find our privacy policy at: whynotgolf.com/privacy-policy.

Web and Mobile Application Development

WhyNotGolf is committed to designing, building, and maintaining secure systems.

• All applications are regularly scanned for common security vulnerabilities including the OWASP Top Ten.
• Regular training on Secure Coding Practices is provided. All engineers must attend training sessions.
• No credit card information is permitted to be stored on any mobile device.
• Use of encryption for both storage and transmission of sensitive information is regularly audited by the WhyNotGolf Security Team.
• All web and mobile applications are primarily developed, tested, deployed, and maintained by a full-time, in-house engineering team.

Encryption

WhyNotGolf uses strong encryption methods and key management procedures to ensure your sensitive information is protected.

• All credit card information is encrypted with strong industry-standard cryptographic protocols such as AES and TLS while in transit through our systems.
• WhyNotGolf’s website is accessible via a 256-bit SSL certificate.
• Credit card information is never stored after transaction authorization.
• Access to encryption keys is held by the smallest number of WhyNotGolf employees possible.

Incident Response

While we don't anticipate there ever being a breach of our systems, we know that no computer system is perfectly secure.

• In the event of a breach of an WhyNotGolf information system, we have a detailed Incident Response plan in place.
• Periodic testing of the response plan.
• WhyNotGolf has 24x7 monitoring of its security systems and alerts.