Performance requires trust.
Sport99 is built on a zero-trust architecture with GDPR Art. 9 health-data consent, EU-hosted infrastructure, and end-to-end encryption. Here’s exactly how we protect you.
Security Foundations
Zero-Trust Architecture
Every request is authenticated and authorized at the API layer. No implicit trust between services.
Row-Level Security (RLS)
PostgreSQL RLS enforces tenant isolation at the database layer. Every query must include tenant_id.
End-to-End Encryption
All data encrypted in transit (TLS 1.3) and at rest (AES-256). L3 Confidential fields never logged in plaintext.
MFA Enforcement
30-day grace period, then mandatory. High-urgency alerts every 4 hours in the final 5 days.
GDPR Art. 9 Consent Gate
Health terms are NER-swept and redacted if ai_health_consent_given = false. No consent, no AI health processing.
Rate Limiting
Per-user, per-tenant rate limits on every endpoint. Auth endpoints capped at 10 req/min. No exceptions.
Azure Key Vault
All production secrets live in Azure Key Vault. Zero plaintext secrets in environment files or logs.
Three layers of AI protection
Every AI request — voice report, injury summary, OKS analysis — passes through three independent protection layers before a language model sees a single token.
System Message Bounding
Every prompt includes athlete identity and tenant scope. The AI can only discuss data from the authorized athlete within the authorized club.
Azure Content Safety
All AI requests pass through Azure Content Safety before and after generation. Hate speech, violence, self-harm — blocked at the infrastructure level.
Health NER Redaction
When health consent is not given, a GPT-4.1-mini NER sweep replaces all health terms with [REDACTED — NO CONSENT] before the prompt reaches any model.
We don’t lock you out on day one
Sport99 uses a “Polite Lock” — a 30-day grace period before MFA is enforced — so teams can adopt it without disruption.
Persistent banner. Set up MFA at your own pace. Full access during grace period.
High-urgency red alert every 4 hours. Link to MFA setup always visible.
Dashboard access blocked until MFA is enabled. One click to enable and immediately regain access.
Four-tier data classification
Every field in our system carries a classification label that controls who can access it, how it is logged, and when it can be exported.
| Level | Examples | Controls Applied |
|---|---|---|
| L4 Restricted | Auth credentials, Key Vault secrets | Azure Key Vault + no logging |
| L3 Confidential | Medical notes, AI summaries | Encrypted + consent gate |
| L2 Internal | Training plans, session logs | Auth + RLS |
| L1 Public | Sport names, benchmark norms | None (publicly accessible) |
Per-tenant rate limits on every endpoint
All API calls are rate-limited per tenant and per user at the network edge — before requests reach application servers. Separate limits apply for authentication, AI features, bulk operations, and standard reads/writes.
Requests that exceed limits receive a standard response with a Retry-After header. This protects against credential stuffing, AI quota exhaustion, and automated scraping.
Our sub-processors
We are transparent about every third party that processes your data. All primary processing occurs inside the EU.
| Provider | Purpose | Region |
|---|---|---|
| Microsoft Azure | Infrastructure, AI, Storage | Sweden Central |
| Stripe | Payment processing | EU |
| Azure Comm. Services | Email delivery | Sweden Central |
If you discover a security vulnerability, please report it to security@sport99.ai before public disclosure. We acknowledge reports within 48 hours and issue fixes for critical findings within 14 days.
Have questions about our security?
Our data protection officers can provide technical whitepapers, DPIAs, and compliance audit reports on request.
Contact Privacy TeamPrivacy-first platform. Built in the EU.
Full GDPR compliance. Sweden Central hosting. Art. 9 health-data consent. Your data, your control.