Client Success Story · Avalon Yacht Club
“I assumed we were covered.” The assessment said otherwise.
How Avalon Yacht Club uncovered hidden security gaps, then built a club-wide IT security program in weeks, without an in-house IT team.
The Assumption
“Minimally compliant” felt safe enough.
Like most club GMs, Joe Mendez believed his club's security posture was in good hands. Jonas and the hosted environment were solid. A firewall was in place. A managed IT provider handled the rest.
“I assumed that we were minimally compliant. I was confident with Jonas and the hosted solution, but not so much outside of that. I assumed my firewall and managed IT provider had us covered.”
The problem: assumption isn't verification. And at a club handling member billing data, payment cards, and personal information, the gap between the two is where risk lives.
The Wake-Up Call
The assessment found what nobody was looking for.
Jonas Compliance's security assessment scored Avalon Yacht Club across nine categories. The hosted systems held up. The exposure was everywhere else.
Security Category Breakdown
Avalon Yacht Club · Basic Security Assessment · July 2026
The biggest surprises weren't in the hosted Jonas environment. Those systems held up. The exposure lived in the places nobody owned: remote access, mobile devices, and password practices that had drifted for years.
“I was disappointed to learn about the ways we were exposed. Staff had been allowed to change their own access passwords. A second or third set of eyes is never too much when it comes to IT security.”
The one perfect score: Data Protection, 100%. The category anchored by the Jonas hosted environment was the strongest area in the entire assessment. The gaps were outside it.
The Fix
A Senior Director of IT Security, without the salary.
For a small club with no ability to staff a dedicated IT team, Jonas Compliance changed the math. Joe worked through the platform himself, routing technical questions directly to his IT providers when he didn't know the answers, and building out documented security procedures at a pace that surprised him.
“The rapid pace for development of procedures, and the ease with which it was accomplished, allowed us to feel much better about our SOP manual as it relates to IT security. As a smaller club, this was a game changer.”
What Avalon built with Jonas Compliance
From Grade D findings to documented, owned procedures
-
A documented incident response planBefore: none
Who to call, what to do, how to communicate -
Vendor accountability
Outside providers now answer for their security practices -
Password and access policies with real enforcement
No more self-managed staff passwords -
A club-wide IT security SOP manual
Built and maintained inside the platform
It was like I was paying a Senior Director of IT Security for much less than minimum wage, with the confidence that they don't have a personal investment in saying we're safe.
Why It Matters For Your Club
Your club is a target. Your assumptions are the vulnerability.
Private clubs combine the data sensitivity of a financial firm with the operational sprawl of a hospitality business. High-net-worth member rosters make clubs attractive targets for fraud and social engineering. Most clubs assume their IT provider has it covered. Avalon did too.
Payment data everywhere
Pro shop, food and beverage, and dues processing all handle cardholder data. Every terminal and every login is in PCI scope, whether anyone is watching it or not.
Member rosters attract fraud
Member files hold names, addresses, billing history, and personal notes on high-net-worth households. A single exposed export can trigger state breach-notification laws.
Nobody owns the gaps
Seasonal turnover, shared POS logins, and third-party vendor access make security hygiene drift by default. Without a second set of eyes, the drift goes unnoticed for years.
“There is absolutely no reason not to work with Jonas Compliance. It is easy to use, very reasonably priced, and forces not just your organization but your outside service providers to become laser focused on information security to protect your members and staff.”
Joseph A. Mendez, CCM, CCE · General Manager, Avalon Yacht ClubFind out what your club is assuming.
Get the same security assessment Avalon Yacht Club used to uncover its gaps, and close them.
Request Your AssessmentEasy to use. Reasonably priced. Built for clubs without an IT department.