Security

• Every record that belongs to a program carries an organization id, and reads and writes are filtered by the signed-in user's organization at the database layer.
• Row-level security is enabled on customer data tables, so isolation is enforced by the database rather than by application code alone.
• Cross-organization access exists only for a small number of platform administrator accounts, checked through a dedicated privileged-role check rather than a client-side flag.
• Demo workspaces are separate organizations with their own data, deleted automatically when the session expires.

• Email and password or Google sign-in, with managed session tokens and server-side verification on every privileged call.
• Roles (for example coach, assistant, trainer, equipment manager, administrator) are stored in a dedicated roles table, never on an editable profile field, to prevent privilege escalation.
• Feature availability per organization is controlled by server-side feature flags and enforced on both navigation and route entry.
• Passwords are hashed by our identity provider; we never store or log plaintext credentials.

• TLS for all traffic between browsers, our application and our providers.
• Encryption at rest for the database, backups and uploaded files as provided by our hosting platform.
• Uploaded logos and attachments are stored in access-controlled buckets and served through short-lived signed URLs rather than public links.
• Secrets and API keys are held in managed secret storage and read only inside server-side handlers, never shipped to the browser.

• Input on public endpoints is schema-validated before it reaches the database.
• Webhook and public API routes verify the caller before performing any write.
• Server functions are the only path to privileged operations; the browser never receives service-level credentials.
• Automated dependency and configuration scanning runs against the codebase, and findings are triaged before release.
• Least-privilege database grants and explicit access policies are required for every new table.

The platform runs on managed, redundant cloud infrastructure with automated database backups retained on a rolling schedule. We test restore procedures periodically. Unless a separate service-level agreement is signed, no contractual uptime commitment applies.

• Keep administrator accounts limited, and remove staff access promptly when roles change.
• Use unique passwords, and enable device-level protections on shared bench and locker-room devices.
• Record only the athlete health and personal information your program is permitted to hold.
• Export data you need to keep before ending a subscription.

Email security@montoakdigital.com with the affected URL, a description, and reproduction steps. We acknowledge reports within five business days and will keep you updated through remediation. Please give us reasonable time to fix an issue before publishing it, test only against accounts you own, avoid accessing other organizations' data, and never run denial-of-service or automated load tests. We will not pursue legal action for good-faith research that follows this guidance.

MontOak Digital LLC — security@montoakdigital.com