Security by design

Security by design means we build security in from the start, in architecture, development and operations, instead of adding it afterwards. We work from three principles: trust through transparency, prevention before reaction and continuous improvement.

On this page we only describe measures we can show in our code or in the documentation of our hosting provider. Where something is not in place, we say so.

CoachBall runs on Laravel Cloud, a managed hosting platform built on Amazon Web Services (AWS) infrastructure, with the Cloudflare network in front of it.

Edge network: every request first reaches the nearest Cloudflare location. There it passes DDoS mitigation and a Web Application Firewall (WAF) before it is forwarded to the application. Static files such as CSS, JavaScript and images are cached at the edge, and that cache is cleared on every deployment.

Compute network: the application runs in a private network and is only reachable through the edge network, not directly from the internet.

• DDoS protection: floods and amplification attacks are absorbed at the edge before they reach the application.
• Web Application Firewall: Cloudflare's OWASP Core Ruleset filters common attacks, such as injection, before they reach the application.
• Encrypted connections: all traffic uses HTTPS (TLS), with certificates that are renewed automatically.
• Security headers: our pages send a Content Security Policy that limits which external domains a page may load from and stops other sites from embedding CoachBall, plus X-Content-Type-Options: nosniff and a strict Referrer-Policy.

• Passwords are stored only as a one-way hash (bcrypt). Nobody can read them, including us.
• Login attempts are rate limited, so passwords cannot be guessed endlessly.
• Cookies are encrypted, and every form is protected against cross-site request forgery (CSRF).
• Access by role: what someone can see and do depends on their role in the team or club, for example coach, player or parent.

Every connection to CoachBall is encrypted, and uploaded photos and files are stored encrypted (AES-256) by our storage provider. Passwords are stored as a one-way hash, and access tokens for connected services such as YouTube are encrypted in our database.

We do not claim that every piece of data is encrypted at the application level. We never sell team information, and you can delete your account and your data at any time.

CoachBall is not certified for ISO/IEC 27001 and has no SOC 2 report. We use the principles of these standards as a guide, for example for access control, encryption and handling incidents.

Our hosting provider Laravel Cloud is ISO/IEC 27001 certified and has a SOC 2 Type 2 attestation for Security, Confidentiality and Availability. That covers the platform CoachBall runs on, not CoachBall itself.

For specific compliance questions, such as a data processing agreement, please contact us.

Security is an ongoing process. We monitor errors and application logs, update dependencies regularly and review our code for security issues. When we find a problem, we fix it and adjust this page if needed.

If you have questions about our approach or need more technical or legal detail, please contact us.