Organization separation
Each organization’s people, programs, payments, schedules, and messages stay scoped to that organization.
Trust model
Easy to understand. Hard to overstep.
Security should not feel mysterious. These are the controls we design into the platform.
Role-based access
Admins, coaches, staff, parents, guardians, and athletes only see the areas their role is meant to use.
Youth data care
Family, guardian, athlete, and consent flows are handled as sensitive youth-activity data.
Safer payments
Payment workflows use Stripe so card handling stays in a trusted payment layer instead of inside general app screens.
Compliance tracking
Policies, waivers, evidence, reminders, incidents, and review states stay connected to the right people and programs.
Reviewable actions
Important operational changes are designed to be visible enough for admins to understand what happened.
Standards and practices
The baseline we build around.
These are practical security and compliance practices customers can recognize without reading a technical policy.
Role-based access controlLeast-privilege permissionsOrganization-scoped dataHTTPS/TLS in productionOWASP-aware web practicesCOPPA-aware youth consent flowsStripe payment handlingAudit-friendly workflowsField encryptionSecure sessionsToken revocationSecurity headersStrict CORSSigned URLsUpload validationWebhook verificationReplay protectionLog redactionData retention