Our commitment. We collect only the data required to run a school carnival, we do not sell or share student data, and every school's records are isolated from those of every other school. Set out below are the controls in place, the legal framework we operate within, and our published policies.
How we protect your data
Security controls are applied in layers across the platform, covering data separation, access, and the detection of and response to anomalous activity.
Tenant isolation
Every record is tied to a school and filtered by an enforced, tenant-scoped query rule. Isolation is logical and applied on every query rather than in individual code paths, so no school can read or reach another school's data.
Role-based access
Staff see only what their role requires. Administrators, marshals, recorders and team managers are each granted least-privilege permissions, and student personal information is gated behind explicit permission checks.
Two-factor authentication
Time-based one-time-password (TOTP) two-factor authentication with trusted-device support and single-use recovery codes. Both administrator-initiated and self-service resets are available.
Account & password security
Passwords are hashed, sign-in is rate-limited, and sensitive actions require the current password to be re-entered. Temporary onboarding passwords must be changed on first use.
Audit logging
Significant data actions, including imports, results changes and exports, are timestamped and recorded. Each entry records the action, the user responsible, the record affected and the originating IP address.
Application hardening
Every response carries a strict set of security headers: a Content-Security-Policy, HSTS over HTTPS, clickjacking protection (X-Frame-Options and frame-ancestors), MIME-sniffing protection and a restrictive Permissions-Policy.
Administrative controls
The platform administration console can be restricted to an approved IP allowlist. Sensitive administrative events raise real-time security alerts to our team.
No personal data in links
Student information is never placed in a URL; only opaque identifiers are used. Public results and self-nomination pages are reached through revocable tokens rather than open access.
All traffic is served over HTTPS/TLS. The live database and every backup are encrypted at rest (AES-256), and two-factor secrets and recovery codes are separately encrypted within the database. We conduct periodic security reviews of our infrastructure, access controls and code.
Legal & regulatory framework
Privacy Act 1988 (Cth)
We operate under the Australian Privacy Act and the Australian Privacy Principles. Schools remain the owner and controller of their data; SportsOrganised acts as a processor on your behalf and supports access, correction and deletion requests.
Notifiable Data Breaches scheme
We follow the NDB scheme (Part IIIC of the Privacy Act). If an eligible breach occurs we notify the OAIC and affected individuals, and we notify your school administrators regardless of eligibility. Our full response process is set out in the breach policy below.
Our policies
Report a vulnerability
We welcome responsible disclosure from security researchers, staff and school administrators. If you believe you have found a security issue, or you suspect a data breach, contact us. Every report is acknowledged within 24 hours.
support@sportsorganised.com