Last updated: August 26, 2026
At Squadneti, protecting the data of coaches, players, parents, and officials is foundational to everything we build. This page outlines the security measures, practices, and policies we have in place to keep your information safe.
Security is not an afterthought at Squadneti — it is embedded into every layer of our platform, from initial design through deployment and ongoing operations. We follow a defense-in-depth approach, applying multiple overlapping safeguards so that no single point of failure can compromise your data. Our dedicated security team continuously monitors, tests, and improves our defenses to stay ahead of evolving threats. We hold ourselves to the same standards we would expect as users: your team rosters, player statistics, schedules, messages, and personal information deserve the highest level of protection.
Squadneti is hosted on enterprise-grade cloud infrastructure within the European Union, leveraging data centers that maintain ISO 27001, SOC 2 Type II, and SOC 3 certifications. Our infrastructure features redundant power supplies, advanced fire suppression, biometric access controls, and 24/7 physical security monitoring.
All production environments are isolated using virtual private clouds with strict network segmentation. We employ firewalls, intrusion detection systems, and DDoS mitigation services to protect against external threats. Infrastructure is provisioned and managed through code (Infrastructure as Code), ensuring consistent, auditable, and repeatable deployments. We maintain separate environments for development, staging, and production, with no customer data ever present in non-production environments.
All data transmitted between your device and Squadneti is encrypted using TLS 1.3, the latest and most secure transport layer protocol. This applies to our website, mobile applications, and all API communications.
Data at rest — including user profiles, team rosters, player statistics, messages, and uploaded files — is encrypted using AES-256, the same standard used by financial institutions and government agencies. Encryption keys are managed through a dedicated key management service with automatic rotation, strict access controls, and full audit logging. Database backups are also encrypted and stored in geographically separate locations within the EU.
User accounts are protected by securely hashed passwords using bcrypt with per-user salts. We support and strongly encourage two-factor authentication (2FA) via authenticator apps and SMS verification.
Internally, Squadneti enforces the principle of least privilege. Employee access to production systems requires multi-factor authentication, VPN connectivity, and explicit role-based authorization. Access rights are reviewed quarterly, and all privileged actions are logged and auditable. No Squadneti employee can view your password, and customer data access by support staff is limited to the minimum necessary, logged in full, and subject to approval workflows.
We follow secure development practices throughout our software lifecycle. Our engineering teams are trained in OWASP Top 10 mitigation, and all code changes undergo mandatory peer review before deployment. We run automated static analysis (SAST) and dependency vulnerability scanning on every build.
Our platform undergoes annual penetration testing by independent third-party security firms, with results reviewed and remediated by our security team. We also maintain a bug bounty program to encourage responsible reporting from the security research community. API endpoints are protected by rate limiting, input validation, and parameterized queries to prevent injection attacks. Session management follows industry best practices with secure, HttpOnly, and SameSite cookie attributes.
Squadneti performs automated daily backups of all databases and critical systems. Backups are encrypted, stored redundantly across multiple availability zones within the EU, and retained for 30 days. We regularly test our backup restoration procedures to ensure data can be recovered quickly and completely in the event of an incident.
Our disaster recovery plan targets a Recovery Point Objective (RPO) of less than 1 hour and a Recovery Time Objective (RTO) of less than 4 hours. Failover mechanisms are automated where possible, and our infrastructure is designed to withstand the loss of an entire availability zone without service interruption.
Squadneti maintains a formal Incident Response Plan that defines clear roles, escalation paths, and communication procedures. Our security team monitors systems 24/7 using centralized logging, anomaly detection, and real-time alerting.
In the event of a confirmed security incident, we follow a structured process: contain the threat, investigate the scope and impact, remediate the vulnerability, and notify affected users and relevant authorities. In compliance with GDPR Article 33, we commit to notifying the appropriate supervisory authority within 72 hours of becoming aware of a personal data breach. Affected users will be notified without undue delay when the breach is likely to result in a high risk to their rights and freedoms. Post-incident reviews are conducted to identify root causes and implement preventive measures.
Squadneti is committed to meeting and exceeding regulatory requirements for data protection and security:
GDPR: We are fully compliant with the EU General Data Protection Regulation. Users can exercise their rights to access, rectify, port, and delete their data at any time. SOC 2 Type II: Our security controls are independently audited annually against the Trust Services Criteria for security, availability, and confidentiality. ISO 27001: Our information security management system is aligned with ISO 27001 standards, with certification in progress. Children's Data Protection: We apply enhanced safeguards for youth player data, including parental consent requirements and minimal data collection, in compliance with GDPR provisions for minors.
We value the work of independent security researchers and welcome responsible disclosure of potential vulnerabilities. If you discover a security issue affecting Squadneti, please report it to security@squadneti.com.
We ask that you provide a detailed description of the vulnerability, steps to reproduce, and allow us reasonable time to investigate and remediate before any public disclosure. We commit to acknowledging your report within 24 hours, providing regular status updates, and recognizing your contribution (with your permission) once the issue is resolved. We will not pursue legal action against researchers who follow responsible disclosure practices.
For security-related questions, concerns, or to report a vulnerability: