SECURITY AT SPORTS I

Every Sports I account is authenticated by the platform's managed authentication service, with email/password and, where enabled, Google sign-in. Passwords are never stored in plain text — the platform manages hashing and credential storage.

Access inside Sports I is granted by role: organisation admin, headteacher, PE lead, teacher, coach, teaching assistant and viewer — plus parent and pupil access only where the school explicitly enables it. See the Access & Permissions page for the full model.

All traffic between users and Sports I is encrypted with TLS/HTTPS.

Encryption at rest is managed by our platform provider. We are confirming the exact scope and will state it here once verified.

Sessions are managed by the platform authentication service, with automatic expiry. Users can sign out at any time, and account deletion ends all access.

Backups are provided and managed by our platform provider. Backup frequency and retention are being confirmed and will be documented here once verified.

Important account and data events (sign-ins, pupil record changes, evidence uploads, exports and deletions) are recorded for review. A fuller audit trail is being rolled out across the platform.

Security and data incidents follow a documented process: Detect → Contain → Assess → Document → Notify → Resolve → Review. Where a school's data is affected, the school is notified without undue delay so it can meet its own UK GDPR notification duties. Confidential incident details are never published on this page.

School admins can see and manage the user accounts and roles for their school at any time. School staff access can be suspended or removed immediately when staff leave.

Sports I is built on a managed platform with authentication, permissions and tenant isolation enforced centrally rather than relying on individual screens being hidden.

All third-party providers used to deliver Sports I are listed in the subprocessor register with their verification status. We do not claim certifications (ISO 27001, Cyber Essentials, SOC 2) or penetration testing that UK PE Group has not actually completed — see Certifications & Assurance for current status.