Data Security
Your Rosters, Documents, And Payment Data Are Protected At Every Layer
HoopOS is built on enterprise-grade managed infrastructure with security controls applied at the database, server, and application level. Not configured later. Not bolted on. Built in from the start.
Infrastructure
Enterprise Infrastructure. Zero Maintenance On Your End.
Automatic security patching, DDoS mitigation, uptime monitoring, and encrypted storage are included by default. You do not manage servers. You do not apply patches. The infrastructure handles it.
Encryption In Transit
All traffic between a user's browser and HoopOS is encrypted using TLS. A person sitting on the same Wi-Fi network at an event cannot intercept roster data, player documents, waiver signatures, or check-in actions. Every page load, every form submission, every API call is HTTPS only.
Encryption At Rest
All stored records including player profiles, compliance documents, roster files, waivers, and payment records are encrypted at the infrastructure level. If someone were to physically access the storage layer, the raw data is unreadable without the encryption keys.
Managed Infrastructure
HoopOS runs on enterprise-grade managed cloud infrastructure. Server patching, DDoS mitigation, firewall configuration, and uptime monitoring are handled at the infrastructure level. We do not manage our own servers, which eliminates the most common class of infrastructure vulnerabilities: unpatched operating systems, exposed ports, and misconfigured firewalls.
Secure Authentication
Passwords are hashed before storage and never stored or transmitted in plain text. New accounts require email verification via a one-time code before login. Sessions are time-limited and invalidated server-side on logout. Users who authenticate through Google sign-in use OAuth 2.0, and no password is stored in HoopOS for those accounts.
API Secret Management
All third-party API keys including payment processor credentials and email delivery secrets are stored in a managed server-side secrets vault. They are never embedded in frontend code, never visible in the browser, and never stored in source control. Only isolated backend functions access them at runtime.
Data Isolation
One Organization Can Never See Another's Data. Ever.
Every record in HoopOS, including teams, players, rosters, compliance documents, event registrations, audit logs, and payment records, is scoped to the organization that owns it. This is enforced at the database layer through row-level security policies on every read, write, and update.
It is not a UI restriction that can be bypassed by a savvy user. A query from one organization cannot return records belonging to another, regardless of what the requesting client sends. The check happens before data leaves the database.
The Enforcement Chain
- 1User logs in and receives a scoped session token
- 2The platform resolves the user's organization membership and identifier
- 3That identifier is stamped onto the user's session
- 4Every row-level security rule scopes all reads and writes to that organization's data
- 5Backend functions independently re-verify organization membership before any privileged operation
No UI manipulation can bypass steps 4 or 5, because those checks happen server-side before any data is returned.
Row-Level Security
What Each Entity Enforces
Events, Teams, Players, Divisions, Games, Check-Ins
Every critical entity carries an organization identifier on both read and write rules. A query from one organization cannot return records belonging to another. This is enforced at the database query level, not in the UI.
Player Records
Readable only by members of the owning organization, by the player's linked parent account, or through a valid secure document-upload link. Writable only by organization staff within their own organization.
Compliance Documents
Readable only by organization members or the player's linked parent. Writable only by organization staff and directors. No cross-organization access under any request path.
Waiver Signatures
Readable only by organization members or the linked player. Deletable only by platform administrators. No guest or external user can delete a signed waiver.
Registration Records
Writable only by organization staff or administrators. Guest portal members can read only their own registration record, not any other team's.
Access Control
Role-Based Access Enforced Server-Side, Not Just In The UI
HoopOS enforces two separate role layers. The UI permission layer is a convenience only. The database-level and function-level checks exist independently of what the UI shows or hides.
Internal Organization Roles
Full platform access. Organization settings, billing, staff management, all event and team data.
Full operational access including events, teams, rosters, compliance, communications, and reports. No billing.
Check-In HQ access, event-day operations, assigned areas. Controlled per-event by the Director.
Their schedule, their compliance documents, their messages. Nothing else.
All role checks are enforced redundantly: at the database (RLS), inside backend functions, and in the UI. Bypassing the UI does not bypass the other two layers.
Guest Portal Roles
Full portal access: roster management, document uploads, schedule, check-in status, and team communications.
Roster and schedule view only. Cannot upload documents or manage the roster.
Their own waiver and compliance documents only. Cannot see other players' records.
Their child's waiver and compliance documents. Same isolation as the Player role.
Portal roles are enforced on every portal page before render, with server-side validation on every data request.
Guest Portal
Guest Teams Get Secure Access. Without An Account.
The guest team portal is used by coaches who are not HoopOS users. It is designed to be accessible without account creation while maintaining strict, layered access controls at every step.
32-Character Random Access Token
Each guest portal link contains a 32-character cryptographically random access token generated at registration. Guessing or brute-forcing a valid token is not computationally feasible.
One-Time Login Code
Even with the correct portal link, a coach must enter a 6-digit code sent to their registered email address. The code is cryptographically generated, expires within a limited window, and is consumed on first use. It cannot be reused after a successful verification.
Lockout After Failed Attempts
Five consecutive failed code attempts locks the authentication flow for that session. This prevents automated brute-force attempts against the one-time code system.
Email-Scoped Delivery
The one-time code is sent only to the specific email address on file for that member. A person cannot request a code for someone else's email address.
Access Revocation
An operator can revoke a guest member's access at any time, which blocks all future code requests and verification attempts regardless of whether the portal link is still valid.
Team-Scoped Portal Session
A guest portal session can only access that team's roster, documents, schedule, and check-in status. No cross-team data is accessible regardless of what token is presented.
Audit Trail
Every Sensitive Action Has A Record.
HoopOS maintains a comprehensive audit log for every event. Every action that affects a team's status, a player's compliance record, a payment, or a document is logged with the staff member's name, timestamp, and full context.
The audit log is organization-scoped and readable only by organization staff. It cannot be disabled, and log entries cannot be deleted by operators.
If an audit log write fails, the error is automatically surfaced as a high-priority issue rather than failing silently. A failed log entry never disappears unnoticed.
What Gets Logged
- Check-ins and check-in reversals, attributed to the staff member who performed them
- Document approvals and rejections, with the reviewer's name and timestamp
- Compliance flag overrides and temporary clearances, with the override reason logged
- Walk-in registrations
- Payment recordings
- Credential issuances
- Registration status changes
- Staff communications sent
Encrypted transmission and storage. Enterprise managed infrastructure. Secure authentication with hashed passwords, OTP verification, and session expiry. Organization-level data isolation enforced at the database and function level. Role-based access control enforced server-side. A cryptographically secured guest portal with expiring one-time codes and lockout. Full audit logging of every sensitive action. That is how HoopOS protects your data.