Strata holds health information about kids and we treat it that way. This page names the specifics: the encryption, the access walls, the subprocessors, the paperwork we sign, and who to call if something ever goes wrong. No vibe language.
TLS 1.2+ on every connection. AES-256 at rest in the database. The app is never served over plain HTTP, and secrets live server-side only, never in the browser.
Staff who can see protected health information are required to use two-factor sign-in with an authenticator code. Athletes and parents can turn it on too.
Isolation is enforced by the database itself with row-level security, not just the interface. One school can never query another's athletes, even if application code has a bug.
Managed database backups with point-in-time recovery, plus a nightly archive of uploaded medical files. Uploaded physicals cannot be deleted from inside the app, by anyone.
Sensitive actions are logged: who viewed, who changed, and when. That trail supports both compliance reviews and your standard-of-care documentation.
All data is hosted in United States cloud regions on infrastructure from Supabase, Vercel, and AWS.
Least privilege isn't a slogan, it's a table. Here is the actual access matrix, simplified.
| Athletic Trainer | S&C Coach | Sports Coach | AD / Admin | Athlete | Parent | |
|---|---|---|---|---|---|---|
| Clinical medical record (evals, notes, treatments) | Full | ✗ | ✗ | ✗ | Own record summary | Via AT updates |
| Availability status (cleared / limited / out) | ✓ | ✓ | Own sport only | ✓ | Own | Own child |
| Concussion protocol detail | ✓ | ✗ | ✗ | Stage only | Own | Own child, via AT |
| Performance testing & programming | ✓ | ✓ | Own sport | ✓ | Own | ✗ |
| Wellness responses | Full | Flags only | Flags only, own sport | Participation counts | Own | ✗ |
| Department reports | ✓ | Performance only | ✗ | De-identified counts | ✗ | ✗ |
Simplified summary of the default role model; the whitepaper documents the full matrix. Schools assign roles and can tighten further.
A plain-English DPA covering data ownership, permitted use, subprocessors, breach notification, and deletion is available on request, before you sign anything. Request it →
We will sign your district's student-data-privacy agreement, including SDPC-style state agreements. Ohio districts first; ask and we'll work through your state's version.
Strata operates under the FERPA school-official model: the school owns and controls the data, use is limited to providing the service, and there is no secondary use.
For high schools these records are generally FERPA education records that HIPAA excludes. We apply HIPAA-grade safeguards regardless, and sign Business Associate Agreements for clinics and other covered entities.
No sale, no advertising, no secondary commercial use of student data. It's a signed contractual commitment, not a website bullet.
Export your data any time. On termination we return it and delete our copies on request. Uploaded physicals are protected from deletion while you're a customer.
The complete list of third parties that touch data, and what each one sees.
| Provider | Role | Data it touches | Posture |
|---|---|---|---|
| Supabase (on AWS) | Database & authentication | Application data | SOC 2 Type II, AES-256 at rest, HIPAA-eligible under BAA |
| Vercel (on AWS) | App hosting & server functions | Data in transit | SOC 2 Type II, automatic TLS, DDoS mitigation |
| Amazon Web Services | Underlying infrastructure | Hosts the above | ISO 27001, SOC 1/2/3 |
| Resend | Transactional email | Names & emails only, no medical data | TLS |
| Anthropic / OpenAI | Optional AI features | De-identified data only, no names, no identifiers | Server-side proxy; schools can disable AI entirely |
Subprocessor SOC 2 reports and DPAs are available on request for your district's files. Certifications reflect each provider's published compliance documentation.
Send your tech director's questionnaire, request the DPA, or grill us on a call. We built this to pass the hard look.
