Strata holds health information about kids and we treat it that way. This page names the specifics: the encryption, the access walls, the subprocessors, the paperwork we sign, and who to call if something ever goes wrong. No vibe language.
TLS 1.2+ on every connection. AES-256 at rest in the database. The app is never served over plain HTTP, and secrets live server-side only, never in the browser.
Available on every account, and enforced at sign-in for anyone enrolled. Staff who can see health information are asked to turn it on and prompted until they do. Signing in with your school Microsoft or Google account satisfies it through the school’s own MFA.
Isolation is enforced by the database itself with row-level security, not just the interface. One school can never query another's athletes, even if application code has a bug.
Managed database backups with point-in-time recovery, plus a nightly archive of uploaded medical files. Uploaded physicals cannot be deleted from inside the app, by anyone.
Sensitive actions are logged: who viewed, who changed, and when. That trail supports both compliance reviews and your standard-of-care documentation.
All data is hosted in United States cloud regions on infrastructure from Supabase, Vercel, and AWS.
Least privilege isn't a slogan, it's a table. Here is the actual access matrix, simplified.
| Athletic Trainer | S&C Coach | Sports Coach | AD / Admin | Athlete | Parent | |
|---|---|---|---|---|---|---|
| Clinical medical record (evals, notes, treatments) | Full | ✗ | ✗ | ✗ | Own record summary | Via AT updates |
| Availability status (cleared / limited / out) | ✓ | ✓ | Own sport only | ✓ | Own | Own child |
| Concussion protocol detail | ✓ | ✗ | ✗ | Stage only | Own | Own child, via AT |
| Performance testing & programming | ✓ | ✓ | Own sport | ✓ | Own | ✗ |
| Wellness responses | Full | Flags only | Flags only, own sport | Participation counts | Own | ✗ |
| Department reports | ✓ | Performance only | ✗ | De-identified counts | ✗ | ✗ |
Simplified summary of the default role model; the whitepaper documents the full matrix. Schools assign roles and can tighten further.
A plain-English DPA covering data ownership, permitted use, subprocessors, breach notification, and deletion is available on request, before you sign anything. Request it →
We will sign your district's student-data-privacy agreement, including SDPC-style state agreements. Ohio districts first; ask and we'll work through your state's version.
Strata operates under the FERPA school-official model: the school owns and controls the data, use is limited to providing the service, and there is no secondary use.
For high schools these records are generally FERPA education records that HIPAA excludes. We apply HIPAA-grade safeguards regardless, and sign Business Associate Agreements for clinics and other covered entities.
No sale, no advertising, no secondary commercial use of student data. It's a signed contractual commitment, not a website bullet.
Export your data any time. On termination we return it and delete our copies on request. Uploaded physicals are protected from deletion while you're a customer.
The complete list of third parties that touch data, and what each one sees.
| Provider | Role | Data it touches | Posture |
|---|---|---|---|
| Supabase (on AWS) | Database & authentication | Application data | SOC 2 Type II, AES-256 at rest, HIPAA-eligible under BAA |
| Vercel (on AWS) | App hosting & server functions | Data in transit | SOC 2 Type II, automatic TLS, DDoS mitigation |
| Amazon Web Services | Underlying infrastructure | Hosts the above | ISO 27001, SOC 1/2/3 |
| Resend | Transactional email | Names & emails only, no medical data | TLS |
| Anthropic / OpenAI | Optional AI features | Only what the task needs. Anonymous numbers for some features; the student’s name and health detail when reading a document or drafting a parent message | Server-side proxy; no training on our data; schools can keep health data away from AI, or disable AI entirely |
| Groq | Speech‑to‑text for voice dictation | The recorded audio, which can carry health detail if that is what was dictated | Server‑side proxy; dictation is switched off completely in no‑PHI mode |
| Your browser’s own dictation (Google / Microsoft) | The phone or laptop’s built‑in speech recognition, where the browser offers it | The audio, sent to the browser maker rather than to us | Not used in no‑PHI mode |
| corsproxy.io / allorigins.win | Fallback relay for fetching a public page, such as a league stats page or a school calendar feed, when our own server cannot | The public web address being fetched and that page’s contents. No athlete data passes through them | Used only after our own server is tried first |
Subprocessor SOC 2 reports and DPAs are available on request for your district's files. Certifications reflect each provider's published compliance documentation.
Send your tech director's questionnaire, request the DPA, or grill us on a call. We built this to pass the hard look.
