Security for coach-scoped athlete data.

Sausage Coach Athlete Manager is built around authenticated coach workspaces. Backend reads and writes are designed to resolve the authenticated request first and apply ownership or role checks before returning data.

The product uses Supabase row-level security as a core boundary, with server-side repository and service logic used to keep access scoped.

Athlete, program, task, commercial, and finance records are designed to stay scoped to the coach or team that owns them. Admin and coach visibility rules are kept separate from regular athlete data access.

When a coach connects Google, Sausage Coach Athlete Manager uses that access to support coaching workflows such as creating folders, copying or updating program sheets, and managing calendar events.

Connection tokens are handled server-side and are not intended to be exposed to the browser. Coaches can revoke Google access from their Google account settings.

• Access to production systems is kept limited to people who need it to operate or support the product.
• Sensitive configuration values are handled as server environment variables.
• Unexpected errors and support cases may be reviewed to keep the service stable and secure.

If you believe you can see another coach's data, access a workspace without permission, or trigger a security issue, stop testing and report it through your designated support or commercial contact with the steps needed to reproduce it.

This page summarizes the security model behind Sausage Coach Athlete Manager. Teams with procurement, compliance, or vendor security requirements can request a formal review through their commercial contact before rollout or expansion.