Security

At CoachOS, Inc., security is foundational — not an afterthought. This page describes the technical and organizational controls we apply to protect the CoachOS Platform, your data, and your students’ information. We are committed to continuous improvement of our security posture.

1. Infrastructure Security

1.1 Cloud Infrastructure

CoachOS is hosted on enterprise-grade cloud infrastructure with SOC 2 Type II and ISO 27001 certifications. Our infrastructure is distributed across multiple availability zones to provide redundancy and high availability.

1.2 Network Security

• DDoS protection: All traffic passes through Cloudflare’s global network, providing enterprise-grade DDoS mitigation.
• Web Application Firewall (WAF): Cloudflare WAF blocks common web application attacks including SQL injection, XSS, and CSRF.
• Rate limiting: API rate limiting is enforced across all endpoints to prevent abuse.
• Private networking: Internal services communicate over private networks. No internal services are exposed to the public internet.

1.3 Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We enforce HSTS and redirect all HTTP traffic to HTTPS.
• At rest: All data stored in our databases and file storage is encrypted using AES-256.
• Database encryption: Supabase-managed PostgreSQL databases use encryption at rest and support row-level security (RLS) policies to isolate tenant data.
• Backups: Database backups are encrypted and stored in geographically separate locations.

2. Application Security

2.1 Authentication and Access Control

• Secure authentication: User authentication is managed through Supabase Auth, implementing industry-standard JWT tokens with short expiry times.
• Multi-factor authentication (MFA): MFA is available and strongly recommended for all accounts, and required for accounts with administrative privileges.
• Password policies: Passwords are hashed using bcrypt. We enforce minimum strength requirements and check against known breached password databases.
• Session management: Sessions are invalidated upon logout. Idle sessions are automatically expired after a configurable period.
• Row-level security: Our database enforces row-level security policies so that users can only access data belonging to their account. Cross-tenant data access is not possible at the database level.

2.2 Secure Development Practices

• Code reviews: All code changes undergo mandatory peer review before merging to production.
• Dependency scanning: Automated dependency vulnerability scanning runs on every pull request and on a daily schedule.
• Static analysis: Automated static analysis tools (SAST) are integrated into our CI/CD pipeline.
• Secret management: Credentials and API keys are managed through a secrets manager. Secrets are never hardcoded in source code.
• OWASP compliance: Our development practices follow OWASP Top 10 guidelines for web application security.

2.3 Video and Media Security

Video content uploaded and streamed through CoachOS is powered by Mux. Video delivery uses signed URLs that expire after a configurable period, ensuring unauthorized users cannot access course content. Video content is stored in encrypted form and is only accessible to enrolled students with active access.

3. Data Security and Isolation

3.1 Multi-Tenancy and Data Isolation

CoachOS is a multi-tenant SaaS platform. Each account’s data is logically isolated using row-level security at the database layer. It is technically impossible for one CoachOS customer to access another customer’s data. Agency sub-accounts are additionally isolated from each other within the same agency workspace.

3.2 Data Residency

Primary data is stored in the United States. We offer no data residency guarantees outside the US at this time. EU customers’ data transfers are governed by standard contractual clauses in accordance with GDPR requirements.

3.3 Data Retention and Deletion

Upon account cancellation, your data remains in a read-only state for 30 days before being permanently deleted. During this period, you can export all your data. Payment records are retained for 7 years to comply with financial recordkeeping requirements.

4. Payments Security

CoachOS does not store payment card information. All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Stripe handles cardholder data within their PCI-compliant environment. CoachOS receives only anonymized payment tokens. For Agency accounts using Stripe Connect, payouts are managed directly by Stripe under their own compliance framework.

5. Operational Security

5.1 Access Controls

• Principle of least privilege: CoachOS employees are granted the minimum level of access required for their role.
• Privileged access management: Access to production systems requires MFA and is logged and audited.
• Access reviews: Employee access rights are reviewed quarterly and revoked promptly upon role change or departure.
• Background checks: All employees with access to production systems undergo background verification.

5.2 Monitoring and Incident Response

• 24/7 monitoring: Our infrastructure is monitored continuously for anomalies, performance issues, and security events.
• Intrusion detection: We operate intrusion detection systems (IDS) across all critical infrastructure components.
• Incident response plan: CoachOS maintains a documented incident response plan. Security incidents are triaged, contained, and remediated according to defined procedures.
• Breach notification: In the event of a data breach affecting your personal information, we will notify you and applicable regulators within the timeframes required by law (72 hours under GDPR, as promptly as practicable under CCPA).

5.3 Business Continuity

• Uptime SLA: CoachOS guarantees 99% uptime SLA for Pro and Agency plans, measured monthly.
• Backups: Database backups are performed daily (full) and every hour (incremental). Backups are retained for 30 days.
• Disaster recovery: We maintain documented disaster recovery procedures with defined recovery time objectives (RTO) and recovery point objectives (RPO).

6. Third-Party Security

CoachOS relies on a number of third-party vendors for key platform capabilities. All critical vendors undergo security review prior to onboarding. Key vendor security certifications include:

• Supabase: SOC 2 Type II, database hosting and authentication
• Stripe: PCI DSS Level 1, payment processing
• Mux: SOC 2 Type II, video hosting and streaming
• Cloudflare: ISO 27001, SOC 2, CDN and DDoS protection
• Resend: Email delivery infrastructure

7. Responsible Disclosure

We encourage security researchers and members of the public to report potential security vulnerabilities in the CoachOS Platform. If you believe you have found a security vulnerability, please contact us at:

Email: security@coachosapp.com
Subject: Security Vulnerability Report

Please include a description of the issue, steps to reproduce, and any supporting materials. We will acknowledge your report within 48 hours and provide a timeline for remediation. We ask that you not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We do not currently offer a formal bug bounty program, but we will acknowledge researchers who responsibly disclose valid vulnerabilities.

8. Compliance

CoachOS operates in compliance with applicable data protection and privacy regulations, including:

• General Data Protection Regulation (GDPR) for EU/EEA users
• California Consumer Privacy Act (CCPA) for California residents
• Children’s Online Privacy Protection Act (COPPA)
• CAN-SPAM Act for commercial email

For compliance questions, contact: legal@coachosapp.com

9. Contact

For security-related inquiries, please contact:

CoachOS, Inc.
6060 N Central Expy, Dallas, TX 75206
Email: security@coachosapp.com