Security & Trust
DojoSync handles families' personal information and payments. Here's how we keep it safe.
Data encryption
Personal information is encrypted both in transit and at rest.
- Sensitive fields — names, emails, phone numbers, and dates of birth — are encrypted at rest with AES-256-GCM, applied automatically at the database layer.
- Email lookups use a separate keyed HMAC hash, so we can find an account without exposing the address.
- All traffic is served over HTTPS/TLS. Encryption keys are rotatable without downtime.
Payments
We never see or store card numbers.
- Payments run through Stripe Connect, a PCI-DSS Level 1 provider. Your school is the merchant of record.
- Card data is collected and stored by Stripe — never on DojoSync servers.
- Refunds, payouts, and disputes are handled through Stripe’s secured infrastructure.
Account security
Strong defaults protect every login.
- Passwords require a 12-character minimum with mixed case and numbers, stored only as bcrypt hashes.
- Accounts lock after repeated failed logins, and authentication endpoints are rate-limited.
- Changing a password or role immediately invalidates existing sessions.
- Optional two-factor authentication (TOTP) with backup codes is available for added protection.
Children’s privacy (COPPA)
Minor data is handled with care.
- Student and competitor profiles for minors are created by a parent, guardian, or the school.
- Photo uploads require a consent confirmation, and any member can flag a photo for review.
- Families can remove a student’s information at any time.
Access & isolation
Each school’s data stays its own.
- Role-based access controls scope every action to a user’s role and, for staff, to their assigned locations.
- Multi-tenant data is isolated per school and enforced at the middleware, controller, and query layers.
- Sensitive actions are recorded in an audit log for accountability.
Platform hardening
Defense in depth across the stack.
- Images are served through expiring signed URLs, not public links.
- URL fetching validates against private network ranges to prevent server-side request forgery.
- Security headers, input sanitization, and per-endpoint rate limiting are applied throughout.
- The platform is independently penetration tested, with findings remediated and retested.
Questions about our security practices, or need details for a compliance review? Email support@dojosync.com.