Built for youth-sports compliance.
Minor data is in scope on day one. We treat compliance like a load-bearing wall — not a checkbox you wallpaper over before launch.
Standards
SOC 2 is on our security roadmap. We will publish the auditor's letter here when the audit completes — we do not claim compliance before then.
Minor data was in scope on day one. Parental consent flows, minimal data retention, deletion-on-request, no behavioral ad targeting.
Adult-to-minor messages route through the minor's guardian. There are NO private channels between an adult staff member and a minor athlete. Incident reporting + audit log built into the platform.
SeasonStand never sees or stores raw card data. All payment processing happens through Stripe Connect, which carries PCI DSS Level 1 certification.
Data practices
TLS 1.3 everywhere. HSTS preload. No HTTP fallback.
Database encryption via Neon (AES-256). File storage in Cloudflare R2 with envelope encryption.
Per-org row-level scoping enforced at the query layer. Multi-tenant invariant: every read filters on org_id.
Clerk-backed sign-in with phone OTP for guardians + email/password fallback. Org admins use the same Clerk identity across multiple orgs without re-auth.
Every state change on incidents, write-offs, financial-aid decisions, cert assignments writes an audit row with actor + timestamp + notes.
NCSI integration for coach + volunteer background checks. SeasonStand never sees the underlying check data — only the pass/fail status + expiration.
Reporting a security concern
Email security@seasonstand.com with details. We respond within one business day. We do not yet have a public bug-bounty program but will credit responsibly-disclosed findings.