At ApexTrack GH, protecting athlete health records, performance data, and financial payroll transactions is our highest technical priority. This document outlines our security architecture and operational controls.
1. Multi-Tenant Data Isolation
ApexTrack GH enforces strict multi-tenant isolation at the database layer using PostgreSQL Row Level Security (RLS). Every database query is bound to the user's authenticated team_id session token. This ensures that coaches, physios, and administrators can only view or mutate records belonging to their specific club.
2. ApexPay Payroll & Financial Security
The ApexPay disbursement engine incorporates institutional security checks:
- Deposit Entitlement Checks: Wallet balances and spending caps are continuously reconciled against verified MoMo top-up deposits to detect and prevent balance discrepancies.
- Automated Disbursement Freezes: In the event of an entitlement drift or transaction mismatch, disbursement routes are automatically locked until administrator review.
- Encrypted Payment Gateway: Top-ups and payouts are executed via PCI-DSS compliant Moolre over TLS encrypted channels.
3. Data Encryption Standards
- In Transit: All HTTP traffic is strictly encrypted using TLS 1.3 encryption.
- At Rest: Databases and file attachments are stored with AES-256 encryption hosted on Supabase cloud infrastructure.
- Authentication: Session management utilizes secure JSON Web Tokens (JWT) with salted password hashing.
4. Backup & Disaster Recovery
Automated daily backups are performed on all PostgreSQL databases, with point-in-time recovery (PITR) enabled to safeguard against data loss.
5. Incident Response & Reporting
If you suspect a security vulnerability or unauthorized access attempt on your club account, please report it immediately to our security team at admin@apextrackgh.com.