Trust & security
What protects your families' data, in plain terms.
A club hands us children's medical details and parents' bank mandates. This page lists the controls that exist today, where each one lives in the product, and — just as important — what is not yet in place.
Every club is walled off in the database
Row-level security on every table keys each row to a club and to the person reading it. Parents see their own family, athletes their own account, coaches their squads, owners their club — enforced by Postgres, not by the screen. 33 automated database tests run against a staging copy on every change, including a role-by-role matrix.
Postgres RLS · SECURITY DEFINER helpers · tests/db/
Medical details are encrypted
Allergies, medical aid and doctor details from the enrolment wizard are sealed with AES-256-GCM using a key derived per club from a master secret that lives only in the hosting environment. Coarse tags (e.g. "Asthma") stay visible for coaches on deck; the detail is decrypted only for authorised staff.
AES-256-GCM · HKDF per club · src/lib/server/medicalVault.js
POPIA: consent, erasure, retention
Consent is captured and stored with each enrolment. A Section 24 erasure request anonymises the athlete's record and issues a downloadable audit certificate. Each club sets its own retention policy. Data is processed in the EU (Supabase, Ireland) with error monitoring in Sentry's EU region; no personal data is sent to Sentry.
enrolment consent · erasure certificate · retention policy · EU-only processing
Passwords, keys and secrets
Logins are handled by Supabase Auth (bcrypt, email verification, password reset). API keys are stored only as a SHA-256 hash and shown once. Webhook payloads are signed with HMAC-SHA256 and a timestamp. Payment card details never touch Pylos — Paystack holds them; we store a token.
Supabase Auth · hashed API keys · signed webhooks · Paystack tokenisation
Every change is tested before it ships
Each change goes through six automated checks — lint, unit tests, a production build, the database security matrix, a full browser suite logged in as each role, and a schema-drift comparison — and is merged only when all six pass. Tests run against a staging database seeded with synthetic data; production data is never copied to test systems.
6 CI checks · 500+ unit · 33 db · 120+ end-to-end · staging-only
Monitored, and honest about it
Application errors go to Sentry with cookies, headers and request bodies stripped. The public status page runs live checks against the app, database, Paystack and email on every visit and keeps 90 days of history you can read yourself.
Sentry (EU) · /status · /api/status.json
Not yet in place
Ask us before you assume. These are the honest gaps.
- SOC 2
- Not yet audited. The controls above are what an auditor would examine; a Type 1 report is planned once a customer requires it.
- Penetration test
- No third-party test has been commissioned yet. Internal security reviews are recorded with each release.
- Uptime commitment
- No contractual SLA on the current plan. Hosting is Vercel (application) and Supabase (database); both publish their own status pages.
Security contact: security@pylossystems.com. Report a vulnerability and we will acknowledge within two working days.