Minor data is in scope on day one. We treat compliance like a load-bearing wall, not a checkbox you wallpaper over before launch.
SOC 2 is on our security roadmap. We will publish the auditor's letter here when the audit completes. We do not claim compliance before then.
Minor data was in scope on day one. Parental consent flows, minimal data retention, deletion-on-request, no behavioral ad targeting.
Adult-to-minor messages route through the minor's guardian. There are NO private channels between an adult staff member and a minor athlete. Incident reporting + audit log built into the platform.
SeasonStand never sees or stores raw card data. All payment processing happens through Stripe Connect, which carries PCI DSS Level 1 certification.
TLS 1.3 everywhere. HSTS preload. No HTTP fallback.
Database encryption via Neon (AES-256). File storage in Cloudflare R2 with envelope encryption.
Per-org row-level scoping enforced at the query layer. Multi-tenant invariant: every read filters on org_id.
Clerk-backed sign-in: email and password, or Continue with Google. Password resets and account recovery run through a one-time code sent to the email address on the account. One identity works across every club a family or staff member belongs to, with no re-auth per org.
Every state change on incidents, write-offs, financial decisions, cert assignments writes an audit row with actor + timestamp + notes.
Coach + volunteer screening status is tracked with expirations, and clearance is enforced before roster or lesson access. SeasonStand never stores the underlying report, only the pass/fail status + expiration.
Email security@seasonstand.com with details. We respond within one business day. We do not yet have a public bug-bounty program but will credit responsibly-disclosed findings.