Security Center
Committed to privacy, security, and school trust.
Sideline Software Inc. builds cloud software with school oversight, strong identity controls, encryption, and youth-safe messaging safeguards. Our trust documents are freely shareable with buyers, districts, and partners.
Primary hosting
AWS · United States
Identity
MFA · SSO · RBAC
Data protection
Encrypted at rest & in transit
Privacy
No ads · No sale of PII
Overview
A single security baseline across Sideline.
Our program covers cloud applications and APIs, school- and youth-facing features, and the shared services used to operate the platform.
Least privilege
Access is role-based and limited to what people and systems need.
Defense in depth
Encryption, network controls, monitoring, and operating practices work together.
Customer control
Schools decide what is public or private and how communications are authorized.
Auditable communication
In-platform messaging is monitored, tracked, and retained for review.
Continuous improvement
Patching, reviews, incident learning, and control updates are ongoing.
Data privacy
Designed for school oversight.
Privacy defaults favor limited collection, authorized visibility, and accountable use of personal information.
Privacy-first defaults
Public display of school or youth information requires customer authorization.
Minimal collection
Sideline collects only information necessary to provide contracted services.
No ads or sale of PII
Personal information is not sold or shared with advertisers for advertising purposes.
Retention with purpose
Data is retained only for service, contract, or legal need; export and deletion follow agreements.
Data security
Layered controls from identity to recovery.
Production workloads run primarily on AWS in the United States, supported by encryption, strong access controls, monitoring, and documented response procedures.
Identity & access
Strong authentication and least-privilege access across Sideline systems.
- MFA required for staff administrative access and enforced for platform authentication
- SSO support for organizational identity providers
- Role-based permissions, access reviews, and prompt offboarding
- Customer organization boundaries isolate private data
Infrastructure & data
Layered cloud, network, storage, and database safeguards.
- Primary production hosting on AWS in the United States
- TLS/HTTPS in transit and encryption at rest, including AES-256 where configured
- Firewalls, security groups, network isolation, and restricted storage policies
- Credentials and keys kept in approved secret stores and IAM roles
Monitoring & resilience
Continuous oversight, regular backups, and documented response practices.
- Monitoring for suspicious or anomalous activity
- Regular automated backups with access controls
- Prompt security updates for systems and dependencies
- Documented incident response, notification, and post-incident learning
K-12 & student privacy
School-controlled and youth-aware.
Sideline supports FERPA-aware handling where schools control education records, COPPA-aware protections where applicable, and California student privacy practice alignment.
These are practice statements, not certifications. Sideline does not claim FERPA or COPPA certification, iKeepSafe certification, SDPC membership, or Student Privacy Pledge membership.
School control
Schools and authorized administrators govern roster visibility, communications, and public display.
Private by default
Without authorization for public or fan-facing display, student and roster details remain private.
No advertising use
Sideline does not sell student PII or use it for targeted advertising.
Data minimization
Only information needed for the authorized experience is collected and shown.
Youth messaging safeguard
No unsupervised coach-to-player 1:1 messaging.
A second authorized adult must be included. Broadcasts are school-controlled, and communications remain in-platform with content, recipients, authorization context, timing, and delivery metadata retained for compliance and safety review.
Responsible AI
AI assists. Schools stay in control.
AI does not replace customer authorization of what may be displayed, messaged, or shared.
Purpose limitation
AI supports defined product features and operations.
Data minimization
Only data needed for the specific feature or task is processed.
Private data
Customer private data is not sold or used to train public foundation models outside approved terms.
Human oversight
Sensitive outputs involving minors, health, or school communications remain under human and customer control.
Documents
Buyer-ready and freely shareable.
The complete Version 1.0 pack includes the following security, privacy, accessibility, and contracting materials. No NDA is required to receive these public documents.
Security Program Overview
Company-wide controls and assurance practices
Data Privacy
Collection, access, retention, messaging, and AI practices
Data Security
AWS hosting, encryption, identity, monitoring, and response
K-12 Privacy & Compliance
FERPA-, COPPA-, and California-aware practices
Responsible AI Principles
Purpose limits, minimization, vendors, and oversight
FERPA / Student Data Privacy
School-control and education-record practices
COPPA / Minors Statement
Authorization and protections for youth contexts
HIPAA-Aligned Safeguards
BAA readiness for applicable engagements
California Student Privacy
SOPIPA- and PPRA-aware practice alignment
Accessibility Conformance Report
January 2026 VPAT-style assessment
Data Privacy Agreements
Process for school and district DPA requests
NIST CSF Alignment
Practice mapping across the NIST CSF functions
The January 2026 accessibility assessment partially supports WCAG 2.0/2.1 A and AA based on axe-core and limited manual checks; it does not claim full AA conformance across every page and state.
Subprocessors
Supporting services, disclosed clearly.
Subprocessors receive only the information needed for their contracted function and are expected not to sell customer PII for advertising.
Cloud infrastructure
Amazon Web Services (AWS)
Hosting, compute, storage, databases, and networking
Identity & productivity
Google Workspace · Customer identity providers
Corporate email, collaboration, administration, and customer SSO
Email delivery
Email service providers, as configured
Transactional and operational customer communications
DNS
DNS providers
Domain name resolution for Sideline domains
Monitoring & logging
AWS-native and supporting tools
Operational monitoring and security visibility
AI & automation
Third-party AI vendors under contract
Assistive product and operational features
Security review
Need information for your review?
Security questionnaires, DPA requests, BAA discussions, accessibility feedback, and current subprocessor requests are welcome.