One boundary, checked every time.

Signing in

You sign in with an email address and password. The browser only ever talks to our own website, which exchanges your credentials with the API and sets a signed session cookie. The cookie is HTTP-only, marked secure, restricted to same-site requests, and expires after thirty days. Signing out revokes the session on the server, not just in the browser.

Keeping clubs apart

Every request to the API resolves to exactly one principal: a signed-in user, a service, or nothing. That principal belongs to one organization, and the organization is bound to the request before any data is touched. Every store reads and writes within that organization only. There is no cross-organization query path.

Roles

Within an organization, accounts carry a role: owner, admin, staff or viewer. Changing coaching records, film sessions and plans needs a staff role or above; administrative pages need owner or admin.

Infrastructure

• Everything runs on Railway. Only the website has a public address; the API, the video worker and the vision service are reachable on the private network only.
• Video and derived files are stored in private object storage; records in a private database. Backups follow the platform’s schedule.
• Secrets live in the platform’s environment configuration, never in the source repository. Session signing uses a high-entropy secret set per deployment.
• The contact form is rate-limited and protected against automated submission.

Your own devices

Kickoff Pulse runs on the coach’s own laptop and keeps its recordings there. Nothing leaves that machine unless you upload it to Debrief. A shared training plan link is read-only and can be revoked by the coach who created it.

Reporting a problem

If you believe you have found a security issue, tell us through the contact page and say it is a security report. We will acknowledge it, keep you informed, and not take action against good-faith research.