Multi-tenant isolation
Every organisation's data is scoped to its tenant. Authorization is always resolved relative to an organisation, so data never crosses tenant boundaries.
Security & Governance
Protecting the people behind the profile.
AOS handles sensitive information about young athletes and students. Security and governance are not features bolted on afterwards — they are the architecture.
EncryptionIn transit & at rest
IsolationPer-tenant scoping
AuditEvery action logged
One secure sign-in, isolated from athlete data
Security architecture
The public website carries no authentication and touches no athlete data. Everything secure lives on the isolated platform, behind layered controls.
Public website
Static marketing pages. No auth, no athlete data — completely separate from the platform.
Lead capture
Demo requests flow to the CRM only. They never touch the secure surface.
Identity & sessions
httpOnly session cookies backed by hashed tokens. Passwords hashed with a strong KDF.
Tenancy & RBAC
Every request is authorized against a role within an organisation, scoped to a workspace.
Domain core & audit
The central profile, consent and guardianship — with cross-cutting audit events.
Authentication flow
How a request is resolved and authorized, every time.
1
Resolve the session
The session user is resolved from the httpOnly aos_session cookie.
2
Resolve access
Memberships → roles → permissions are walked to build the exact permission set.
3
Enforce the capability
The specific permission required by the action is checked before anything runs.
4
Record the event
The outcome is written to the audit trail for a trustworthy history.
Permission model
Access is granted through roles within an organisation — a governed catalogue, never ad-hoc flags.
Platform adminImplicitly holds every permission across the platform.
Organisation roleApplies org-wide when no workspace is set.
Workspace roleNarrowed to a single workspace within the org.
GuardianAttached to an athlete through guardianship & consent.
Controls built into the platform
The guarantees that hold across every workspace.
Role-based access control
Access is granted through roles within an organisation, optionally narrowed to a single workspace. Permissions are a governed catalogue.
Consent & guardianship
Data sharing is explicit. Consent records and guardianship links make it clear who can see what — and consent can be withdrawn.
Encryption overview
Traffic is protected in transit with TLS; sensitive credentials are hashed, never stored in plain text. Sessions use hashed tokens.
Audit workflow
Cross-cutting audit events give organisations a trustworthy record of what happened and when, across the ecosystem.
Separation of surfaces
The public website carries no authentication and touches no athlete data. Everything secure lives on the isolated platform.
A consent-led privacy process
Sharing is always a deliberate, reversible choice made by the athlete or their guardian.
1
Request
An organisation requests access to specific data.
2
Consent
The athlete or guardian grants scoped, explicit consent.
3
Access
Access is granted only within that consent, and logged.
4
Withdraw
Consent can be withdrawn at any time, ending access.
Review our approach with your team
We're happy to walk security, privacy and data-governance stakeholders through the model in detail.