Security at Rizora

Rizora.io LLC

Most athletes on Rizora are minors, and families trust us with their film, their numbers, and their recruiting decisions. We treat protecting that information as part of the product, not an add-on. This page describes how we do it.

To report a vulnerability, see our Vulnerability Disclosure Policy or email security@rizora.io.

Access control enforced in the database

• Every table has row-level security. Who can read or change a record is enforced by the database itself, not just by the app's screens. Access policies are designed with each table, never added later.
• Sensitive changes go through controlled functions. Consent, sharing grants, verification, trainer measurements, and payment entitlements can only change through specific server functions that check permissions and write to the audit log.
• Automated permission tests on every change. We maintain a suite of hundreds of automated tests that prove each account type can see only what it should, including that roles can't see into each other, trainers can't reach recruiting data, and programs can't see athletes who haven't shared with them. Every database change must pass the full suite before it reaches production.
• The AI assistant has no extra powers. It runs with the signed-in user's own permissions, can't read anything the user can't, proposes changes instead of making them, and can't touch consent, grants, verification, payments, or scores. All AI calls happen on our servers, never from your device.

Accounts and sign-in

• Passwordless sign-in. You sign in with a one-time code sent to your email, so there's no Rizora password to steal or reuse.
• Verified adults only. High school and college staff must use a school email and pass verification; a program's head coach or athletic director approves additional staff. Trainers and evaluators are identity-verified before they can work with athletes, and trainers' background checks are tracked with expiry dates. We treat this as a child-safety control, not just fraud prevention.
• Periodic re-verification for college athletes and staff, so access ends when someone's affiliation does.
• Clean session switching. Signing out clears the previous user's data from the device, which matters on shared family phones and tablets.

Media protection

• Files are stored in private storage and served only through short-lived signed links. Nothing is served from a public URL.
• Location and other metadata are stripped from photos and video on upload.
• Programs can play clips but can't download them, and clips shown to programs are watermarked.
• Clips created for social sharing are kept separate and can never appear in recruiting or evaluation.
• Anonymized clips for college athletes are reviewed by a person before release, and the athlete approves each one.

Infrastructure and data protection

• Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure providers.
• Development and production are separate, with separate databases and credentials. Test and demo tools are never deployed to production.
• Payments are handled by Stripe. Card numbers never touch Rizora's servers.
• Secrets are stored in our providers' secret managers, never in source code.
• Production staff access is limited to a very small number of Rizora staff, and access to sensitive records is logged.

How we build

• Every code change goes through pull-request review, including automated code review, before it merges.
• Production releases use a two-step confirmation: the exact change is reviewed before it is applied, then verified after.
• Database changes are additive: we never edit a change that's already been applied, which keeps the history auditable.
• Dependencies are kept up to date and checked for known vulnerabilities.

Audit log

Every consent action, sharing grant, verification decision, evaluation, trainer-entered measurement, confirmed assistant action, and payment entitlement change is written to an append-only audit log. It lets us prove that consent was given, investigate problems, and detect abuse.

Incident response

If we suspect a security incident, we work to contain it, investigate, fix the cause, and add protections against a repeat. If an incident affects your personal information, we'll notify affected users, and the parents or guardians of affected minors, without unreasonable delay and as required by law, and we'll tell you what happened and what we're doing about it.

Questions

Security questions or concerns: security@rizora.io Schools and programs completing a vendor review can request our security documentation at the same address. We can complete standard higher-education questionnaires such as the HECVAT. We do not yet hold a SOC 2 report.