Security at Athletic Assist
This page is for the person who has to approve a new tool. It says what is true today and what is not yet.
One school cannot reach another's data
Separation is enforced in the database, not in the application code. Every table holding a school's data has PostgreSQL row-level security turned on and forced, so a query runs inside a school's context or it returns nothing. Records that reference each other carry the school's identifier in the key itself, so a row cannot point at another school's row even if the security policy were switched off.
The account the application connects with cannot bypass those policies and cannot grant itself the ability to. Reference data shared by every school, the national school directory, is read-only to the application, enforced by database privilege and checked automatically.
Getting in
The pilot sits behind Cloudflare Access. Only email addresses on a named list reach it at all, and they sign in with a one-time code sent to that address. There is no password to steal or reuse.
Where the data lives
A managed PostgreSQL database run by Neon, in the United States. Neon's published security documentation states that data is encrypted at rest with AES-256, that every connection requires TLS 1.2 or 1.3, and that Neon is audited annually against SOC 2 and ISO 27001. The application is hosted on Railway.
Athletic Assist sends from its own domain, authenticated with DKIM and a verified return path, so receiving mail servers can confirm the message is genuinely ours.
We have no access to anyone's mailbox. We do not connect to Gmail or Outlook, we never ask for an email password, and we cannot read your staff's mail. Messages go out from our domain with the school's name on them and replies are collected in the app for them to see.
Student data
There is none. Athletic Assist holds schedules and the contact details of adults who work games. Student information has been out of scope since the first day of the project and the system has nowhere to put it.
What we do not have yet, stated plainly
Athletic Assist is a new product in a pilot with one school. We do not have a SOC 2 report, a completed penetration test, a documented incident-response process, or an uptime commitment. We are not offering a signed data processing agreement yet.
If any of those is a requirement for your district, tell us and we will say honestly where we are rather than work around it.