vitalforg
Talk to usExplore demo

Security

Security and data protection

How VitalForg protects your accounts, your workspace and your athletes’ data.

Account authentication

  • Every user signs in with their own email address and a password of at least 10 characters. Passwords are stored only as salted one-way hashes.
  • Two-step sign-in with an authenticator app is available to every user, with one-time recovery codes.
  • Repeated failed sign-ins are locked for 15 minutes. Password reset links work once and expire after 60 minutes.
  • Sessions end after 8 hours of inactivity. The session cookie is HttpOnly and sent only over secure connections.

Workspace separation and roles

  • Each organization works in its own workspace. Permission checks run on the server for every request, so one workspace cannot read another’s data.
  • Four roles (owner, admin, analyst and viewer) control who can import data, review flags, manage members and undo imports.
  • Imports, flag reviews, membership changes, API key changes and data exports are recorded in an activity log that workspace admins can read.
  • Forms are protected against cross-site request forgery.

Secure connections and API access

  • Signed-in use and the data import API work only over HTTPS.
  • Workspace admins create API keys with only the permissions a system needs. Keys are shown once, stored only as a hash and can be revoked at any time.
  • Each key works only for its own workspace. Requests are rate limited, every record is validated, a submission is saved in full or not at all, and each import is recorded in the activity log.

Backups, export and deletion

  • The database and site files are backed up daily in encrypted form and stored outside the public website, with the encryption key kept separately.
  • Admins can export everything held about an athlete, and owners can export a whole workspace.
  • Deleting an athlete, a workspace or an account removes the data from the live service. Deleted data disappears from backups as they expire and is deleted again if a backup is ever restored.
  • VitalForg uses no tracking or advertising cookies, and its pages load nothing from other companies.

Security contact

To report a security concern or suspected unauthorized access, email jennifer@vitalforg.com. For security questions about your organization’s requirements, contact us.