Security

• Every table holding personal data is protected by row-level security enforced in the database, not in application code. A missing UI check cannot expose another member's data.
• Sensitive athlete detail — contact information, documents, assessment internals — is readable only by the athlete, their guardian, and verified organisations the athlete has chosen to be discoverable to.
• Administrative capability is granted through a separate roles table checked server-side. Roles are never stored in a profile record or trusted from the browser.
• Privileged service credentials are used only inside server-side handlers, after the caller's role has been verified.

• Encryption in transit (TLS) everywhere, and encryption at rest for the database, file storage and backups.
• Uploaded documents and media live in access-controlled storage with signed, time-limited URLs.
• Guardian contact details are stored as salted hashes where we only need to verify a match.
• Secrets are held in a managed secret store, never in source control.

• Automated security scanning runs against the schema and dependency tree, and findings are triaged before release.
• Audit logging records administrative and moderation actions with actor, action, target and reason.
• Retention jobs run on a schedule and delete data past its stated retention period.
• Managed daily backups with point-in-time recovery.
• Least privilege for staff access, with production access limited to what a role requires.

We maintain a breach register. If a personal data breach is likely to result in a risk to people's rights, we notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected members without undue delay where the risk is high. The number of notifiable breaches in the last 12 months is published on the privacy commitments — including when that number is zero.

Found a vulnerability? Report it to security@striide.app — machine-readable contact at /.well-known/security.txt. We acknowledge within 3 working days, will not pursue legal action against good-faith research that respects member privacy, and will credit you if you would like us to. Please do not access data belonging to other members, degrade the service, or publish before we have had a reasonable chance to fix the issue.