Security

A team's playbook is private. Here's how we keep it that way.

Every team is kept apart

Each team has its own site and its own separate database. A team's playbook, roster and quiz results live in that team's own database. We run an isolation test that tries to reach one team's information while signed in to another, and it has to come back empty.

Signing in

Teams are invite-only: a coach adds each player by email. Signing in on a new device needs a password plus a two-step sign-in code sent by email. Each person can choose to have up to two devices remembered for 90 days. A coach can sign a player out of every device at once.

Checked on the server

Sign-in is checked by our server on every page and file the team site serves, not just in the browser. Without a valid sign-in, nothing on a team site loads except the sign-in page. (Videos or files a school chooses to link from its own storage are protected by the school's own system.)

Encrypted connections and backups

Every page uses HTTPS. Each team's database is backed up nightly to private, encrypted storage.

What we collect

As little as possible: a user's email address, team, role and side of the ball, plus quiz results. We don't ask for names, birthdays, addresses or photos of players. Details are in our Privacy Policy.

Our own accounts

Every admin account we use to run InstallFootball has two-step sign-in turned on.

Questions

Schools and IT teams can email InstallFootballOfficial@gmail.com for more detail.