Security
How we keep your data safe.
Protecting athlete and organisation data is core to everything we build. Security is designed into the platform, not bolted on afterwards.
Our practices
- Encryption in transit (TLS) and at rest for all stored data.
- Strict tenant isolation — every record is scoped to its organisation.
- Role-based access control so users only see what their role permits.
- Signed, HTTP-only session cookies to protect authentication.
- Continuous monitoring and regular dependency updates.
Subprocessors
A small number of specialist infrastructure providers help us operate SprtIQ, each given access only to what its specific function requires:
- Vercel — application hosting.
- Supabase — database hosting (PostgreSQL, on AWS in the EU).
- Resend — transactional email delivery.
- Sentry — application error monitoring.
- Upstash — Redis holding rate-limit counters (keyed on IP address and email address).
- Cloudflare — Turnstile, the check on the public signup form that tells a person from a script. It receives the IP address and browser details of someone registering a new organisation, and nothing they type into the form. It is not used on sign-in or anywhere inside the product, so athletes, parents and staff are never sent to it.
- Together AI and OpenRouter — the AI models behind the optional drafting, summarising and translation features. These run only when someone actively uses one of those features, and the request content is processed outside the EU. They are off unless an organisation switches them on under Admin → Institution Settings → AI assistance; while they are off, no content is sent to these providers at all.
- Paystack — card payments, where an organisation connects its own gateway account. Peach Payments, Ozow and Payfast are built but not yet activated. No organisation has connected a gateway, so no payment is processed today and SprtIQ never holds funds.
- Meta (WhatsApp Cloud API), Microsoft Teams and Google Chat — outbound messaging, where an organisation supplies its own credentials or webhook. None is connected today. These become subprocessors only for an organisation that opts in, and only for the messages it sends through them.
Reporting a vulnerability
If you believe you've found a security issue, please email security@sprtiq.com — the same address published in our security.txt. We take all reports seriously and will acknowledge your message promptly.