Safety & Security

Protecting minors and SafeSport alignment

Youth sports organizations in the United States are expected to follow the U.S. Center for SafeSport Minor Athlete Abuse Prevention Policies (MAAPP), which require that electronic communication between an adult (coach, staff, volunteer) and a minor athlete not be one to one and private.

Waresport is built with this in mind. The platform is configured so that a coach or staff member cannot start a direct, one to one private message thread with a minor athlete. Messages intended for a minor are routed through, or copied to, a parent or guardian on file. Group communications include the appropriate adult recipients so there is transparency for the parent or guardian.

Clubs remain responsible for their own safeguarding policies, background checks and supervision of any communication that happens outside the platform. Waresport provides the tools to make compliant communication the default path.

Payments and financial data

All payments on Waresport are processed by Stripe, a PCI DSS Level 1 certified payment service provider. Card numbers, bank account numbers and other sensitive payment details are collected by Stripe's secure elements and sent directly to Stripe. Waresport does not see or store full card numbers or bank credentials.

Waresport stores transaction metadata such as amount, status, transaction identifier and the last four digits of a card, which is used for receipts, reconciliation and support.

Infrastructure and application security

• Traffic to the platform is served over HTTPS using modern TLS.
• Databases and object storage used by Waresport are encrypted at rest.
• Access to production is limited to authorized personnel using least privilege.
• Automated backups run on our production databases.
• Application logs and error monitoring are used to detect and investigate issues.
• Third party dependencies are monitored for known vulnerabilities and updated.
• Non production environments use separate data from production.

Account security for club admins

• Passwords are stored as salted hashes, never in plain text.
• Role based access separates admins, coaches, staff and parents.
• Admin permissions can be scoped so staff only see what they need.
• Sensitive changes such as bank account updates trigger notifications.

Data ownership and portability

Clubs own their data. Admins can export member lists, registration data, payment history and schedules from within the platform. Closing an account removes access and starts our deletion process, as described in our Privacy Policy.

Shared responsibility

Security is a shared responsibility. Waresport protects the platform, and clubs are responsible for:

• Using strong, unique passwords for admin accounts.
• Granting admin access only to people who need it, and removing access promptly when a role changes.
• Configuring communication and safeguarding rules that match their own policies and local law.
• Handling background checks, in person supervision and other physical safety measures.

Report a safety concern

If you have a safety concern about an athlete, coach or staff member, please contact your club administrator first. In an emergency, contact local emergency services. In the United States, abuse in sport can also be reported to the U.S. Center for SafeSport.