Trust

Security at AthletIQ

Athlete data is medical-adjacent, often belongs to minors, and is never ours to be casual with. This page is a plain account of what we do, what we inherit, and what we have not done yet.

Isolation is enforced by the database, not the app code

Every organization's data is separated at the Postgres row level. Access rules live in the database as row-level security policies, so an ordinary application query cannot return another club's rows — the database refuses them. A small number of audited server-only paths run with elevated privileges and are reviewed separately.

Those rules are not assumed to work. A dedicated database test suite asserts cross-tenant isolation directly against Postgres, including attempts to read and write across organization boundaries, and it runs in CI against every database change.

Your database runs in Canada

AthletIQ's production database runs in ca-central-1 (Montreal), on Canadian soil. Verified 2026-07-27 against the live infrastructure; the evidence trail lives in our compliance index. Some subprocessors operate outside Canada — application compute (Vercel), payments (Stripe), error telemetry (Sentry), and rate-limit counters (Upstash).

Infrastructure

AthletIQ runs on Vercel, Supabase (Postgres), and Stripe. Each of those providers maintains its own SOC 2 Type II certification, and we rely on the physical, network, and platform controls those audits cover.

AthletIQ itself is not SOC 2 certified. We are a small team and we have not undergone an independent audit. We would rather say that plainly than imply a badge we do not hold.

Practices we've actually shipped

  • Security response headers on every application response — clickjacking protection, MIME-sniff protection, and a restrictive referrer policy. (Full Content-Security-Policy is in progress; we run frame-ancestors enforcement today.)
  • Rate limiting on sensitive operations, with denials sampled into the security event log.
  • An append-only security event log — role changes, member removals, organization creation, and rate-limit denials — with a written weekly-review runbook.
  • Payment webhooks from Stripe are cryptographically signature-verified before we act on them. We never see or store card numbers; Stripe does.
  • Server-side secrets are kept separate from anything shipped to the browser.
  • Database changes follow an expand-then-contract discipline, and destructive schema statements are blocked automatically in CI.
  • Written incident-response and backup/restore runbooks, including a restore-drill procedure we have not yet executed.

Privacy and regulation

PIPEDA is the framework we build to, and we track Quebec's Law 25 as it applies to us. We collect what a coaching organization needs to run and nothing we cannot justify.

Guardian consent for minors is work in progress — the flows are specified and being built, and are not complete today. We will say so here when they ship.

What we don't claim

We are not SOC 2, ISO 27001, or HIPAA certified. We have not had a third-party penetration test. We do not have a bug bounty programme yet.

Found something? Email hello@athletiq.fitness and we will respond.