Security at PRYZE™

Our Security Commitment

PRYZE™ is an AI-native platform handling sensitive data about student-athletes, including minors. Security is not a feature — it is a platform baseline. Every component is built with security-first design from the first line of code.

Encryption

• In transit: All communications use TLS 1.3. HTTP connections are automatically redirected to HTTPS.
• At rest: All database data is encrypted at rest using AES-256. Storage volumes are encrypted.
• Secrets: All application secrets are stored in AWS Secrets Manager. No secrets are stored in source code or environment variable files committed to version control.

Access Control

• Row-Level Security (RLS): Every database table enforces RLS policies. Users can only access data they are explicitly authorized to see.
• Role-based access: Athletes, coaches, parents, and platform administrators each have separate access scopes enforced at the database layer.
• COPPA controls: Accounts for users under 13 require Verifiable Parental Consent. Data access for minors is further restricted beyond standard RLS.
• Authentication: Multi-factor authentication is available on all accounts. Session tokens are rotated on privilege escalation.

SOC 2 Type II

PRYZE™ is pursuing SOC 2 Type II certification. Our security controls are designed to meet the Trust Services Criteria covering Security, Availability, and Confidentiality. Audit procedures are ongoing.

Enterprise customers requiring a copy of our SOC 2 report upon certification completion may contact info@25alpha.ai.

Infrastructure

• Hosted on Amazon Web Services (AWS) in us-east-1 — application containers run on ECS Fargate behind an application load balancer.
• Database: Amazon RDS for PostgreSQL with AES-256 encryption at rest, automated backups, and point-in-time recovery.
• All data in transit is protected with TLS 1.2 or higher.
• DNS: Cloudflare with DNSSEC and proxy protection active.
• PRYZE operates its own dedicated AWS account. Infrastructure is never shared with other platforms.

Responsible Disclosure

If you discover a security vulnerability in PRYZE™, we ask that you report it responsibly to us before public disclosure. We commit to:

• Acknowledging your report within 2 business days.
• Providing a status update within 5 business days.
• Crediting responsible disclosure reports in our security acknowledgments (unless you prefer anonymity).
• Not pursuing legal action against researchers acting in good faith.

Report vulnerabilities to: info@25alpha.ai with subject line “Security Vulnerability Report”. Please include a description of the vulnerability, steps to reproduce, and potential impact.

Do not include vulnerability details in a public forum, social media, or bug tracker before we have had a reasonable opportunity to address the issue.

Data Practices

• Never sold: Athlete data is never sold to third parties or advertisers.
• FERPA: Academic data is accepted only through parent-uploaded documents. PRYZE never connects to school systems or databases directly.
• COPPA: Data collection on users under 13 requires Verifiable Parental Consent before any data is stored.
• Audit logging: All sensitive data access is logged in an append-only audit trail with a minimum 7-year retention period.

For the complete picture of our data practices, see our Privacy Policy.

Contact

Security questions and vulnerability reports: info@25alpha.ai
25 Alpha LLC · 8 The Green STE A · Dover, DE 19901