Security & compliance

Tracker maintains SOC2 Type II compliance with annual third-party audit of security, availability, and confidentiality controls.

Our platform is designed for NCAA-compliant data handling practices required by collegiate athletic departments.

For programs subject to FERPA, Tracker operates as a service provider / school official under the institution's direction. Customer Data including education records remains owned by the institution.

We support institutional requirements for student privacy and biometric privacy laws applicable to athlete data.

Accessibility: we are working toward WCAG 2.1 AA conformance across customer-facing platform surfaces.

All data in transit is encrypted using TLS 1.2 or higher.

All data at rest is encrypted using AES-256.

Encryption keys are managed through our cloud infrastructure provider with regular rotation.

Customer Data — including game film, roster records, statistics, and financial models — is never sold or used to train models for other customers without explicit agreement.

Role-based access control (RBAC) restricts data visibility by user role within your organization.

Multi-factor authentication (MFA) is available for all accounts and recommended for administrative users.

Administrative and privileged access is logged, monitored, and reviewed.

Accounts are provisioned and deprovisioned per customer request. Customers are responsible for credential security within their organization.

Production infrastructure runs on enterprise cloud providers with US-based data residency.

GPU and compute workloads for Vision Core are isolated from customer-facing application tiers.

We target 99.9%+ platform availability for production deployments.

Infrastructure is managed as code with change control, automated deployment pipelines, and environment separation between development, staging, and production.

Centralized logging, metrics, and alerting cover platform services, API endpoints, and infrastructure health.

We maintain a documented incident response plan with defined escalation paths.

If we become aware of a security breach affecting Customer Data, we notify affected customers without undue delay and cooperate in good faith to address it.

Affected customers are notified within 72 hours of confirmed breaches where required by applicable regulations.

Retention policies follow your subscription agreement. On termination, customers receive a reasonable opportunity to export Customer Data.

Deletion requests are processed within 30 days of account termination, except for copies required by law or legitimate business records.

Anonymized, aggregated data that does not identify your program or athletes may be used to improve models and the Service.

Third-party subprocessors undergo security review before integration and are bound by contractual data protection terms.

A current subprocessor list is available upon request for university IT and procurement reviews.

We evaluate cloud providers, email delivery, and infrastructure vendors against our security requirements before onboarding.

Secure development practices include code review, dependency monitoring, and environment separation.

Vulnerability remediation follows a risk-based prioritization framework.

Penetration testing and security assessments are conducted on a regular cadence and before major releases.

Customers agree not to reverse-engineer, scrape, or extract source code or models — and we protect the platform accordingly.