Mission Viejo High School Football

Trust & Safety

Last updated: March 23, 2026

Your trust is our priority. Mission Football is built with enterprise-grade security to protect the data of our players, families, and coaching staff. Every layer of the platform — from login to messaging to payments — has been designed with adversarial threat modeling and defense-in-depth principles.

Data Protection

  • All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption — the same standards used by banks and healthcare systems.
  • End-to-end encrypted messaging means that message content is encrypted on your device before it ever leaves. Our servers never see the plaintext content of your conversations.
  • Private encryption keys are stored in hardware-backed secure enclaves (iOS Secure Enclave, Android Keystore) — isolated from the rest of the device and inaccessible to other apps.
  • No sensitive financial data is ever stored on our servers. All payments are processed securely by Stripe.

Authentication & Access Control

  • Multi-factor authentication support adds an extra layer of protection beyond your password.
  • Biometric login with Face ID and Touch ID for fast, secure access.
  • Role-based access control ensures that players, parents, coaches, and administrators each see only the information relevant to their role.
  • Roles are cryptographically signed and server-enforced — they cannot be modified by any app or device. Even if someone tampers with the app locally, the server will reject any unauthorized role claims.

Device Integrity

  • Device attestation verifies that every request to our servers comes from an authentic, untampered version of the Mission Football app.
  • We use Android Play Integrity and Apple App Attest to validate device and app authenticity at the platform level.
  • Compromised, rooted, or jailbroken devices are detected and restricted from accessing sensitive features.

Monitoring & Incident Response

  • Automated anomaly detection monitors for suspicious activity around the clock.
  • Real-time alerts flag unusual patterns such as mass data access attempts, privilege escalation, or abnormal usage behavior.
  • Comprehensive audit logging records all administrative actions, providing a complete trail for accountability and forensic review.
  • A dedicated security contact is available for reporting concerns or suspected incidents.

Payment Security

  • All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor — the highest level of certification in the payment industry.
  • No credit card numbers, bank account details, or financial credentials ever touch our servers.
  • Webhook integrity verification ensures that payment notifications cannot be forged or tampered with.

Infrastructure

  • Hosted on Google Cloud Platform(Firebase), leveraging Google's world-class data center security and reliability.
  • Automatic SSL certificate management ensures all connections are encrypted without manual intervention.
  • All secrets and credentials are stored in Google Cloud Secret Manager — never hardcoded in source code.
  • Continuous deployment with mandatory code review requirements ensures that every change is reviewed before reaching production.

Third-Party Security

  • All third-party integrations use API keys stored in secure vaults, never in application code or configuration files.
  • Service-to-service communication is authenticated via Google Cloud IAM with OIDC tokens, eliminating the need for shared secrets.
  • No shared secrets exist in production environments — all authentication is identity-based and automatically rotated.

Student Data Privacy

  • We comply with applicable student data privacy requirements.
  • Minimal data collection— we only store what's necessary to operate the football program. We do not collect academic records, grades, or information unrelated to athletics.
  • No data is sold to third parties, ever.Your family's information is never monetized.
  • Parents and guardians can request a full data export or deletion at any time by contacting us.

Security Contact

If you have security concerns, questions about our data practices, or want to report a vulnerability, please contact us at:

mark@missionfootball.org

Mission Viejo High School Football
25025 Chrisanta Drive
Mission Viejo, CA 92691