Security & Trust
Your team’s data deserves serious protection
BenchIQ holds your drills, film, stats, rosters, and messages — much of it about kids. We treat that responsibility as the product's foundation, not a feature.
SOC 2 certified infrastructureEncrypted in transit & at restPer-team data isolationYouth-safe AI rules
How we protect it
The practices behind the promises
Infrastructure
- Hosted on SOC 2 Type II certified cloud providers (Vercel, Supabase, Cloudflare, Stripe)
- All traffic encrypted in transit (TLS); data encrypted at rest
- Managed PostgreSQL with automated backups
- Media delivered through a global CDN with DDoS protection
Team isolation & access control
- Row-level security enforced in the database on every table — your team's data is invisible to every other team, even in the event of an application bug
- Role-based permissions: owners, coaches, managers, athletes, and family members each see exactly what their role allows
- Membership is invitation-based — nobody joins a team space without a coach or manager letting them in
- Athlete accounts for minors are created and linked with guardian consent
- Sign-in via Google or email magic links — BenchIQ never stores passwords
Film & media
- Video, photos, and recordings live in private storage — there are no public buckets
- Every media URL is signed and short-lived; access is re-checked against your team role on every request
- Athlete-addressed film is visible to that athlete's family and coaches — sharing beyond the team is always an explicit choice
- Deleting media removes it from storage, not just from the page
Payments
- All payments are processed by Stripe — card numbers never touch BenchIQ servers
- Club registration payments run on Stripe's connected-account rails with transparent fee handling
- Subscriptions are managed through Stripe's own billing portal
AI & youth safety
- AI features are age-aware: athletes under 13 never get an open-ended AI chat, full stop
- AI answers are grounded in your team's own data and cited sources — not invented
- Data sent to our AI provider is not used to train models
- AI usage is metered and visible, with per-plan limits
Your data
- Nothing saves in the background — every save is an explicit action you take
- Your data is never sold or shared with advertisers
- Drills and plans export to portable files you can keep
- Account deletion is available in your account settings, with a grace window in case you change your mind
Reporting a vulnerability
If you discover a security issue, please report it responsibly to BenchIQ@benchiq.hockey with “Security” in the subject line. We’ll respond within 48 hours. Please give us the chance to fix the issue before any public disclosure.
Looking for the legal documents? Read our Terms and Privacy Policy.
Questions about our security practices?
Clubs and associations evaluating BenchIQ: we're happy to walk through any of this in detail.