Security at ChalkLine

This page is for the IT and security reviewers at a county or district. It describes the controls built into ChalkLine today, in plain terms. Where something is planned rather than done, it says so.

ChalkLine holds staff contact details, athletic schedules, messages and an audit log. It doesn't hold student personal data. See the privacy policy for exactly what's collected.

Each county is its own tenant. Every record in the database carries its county's ID, and every query the server runs is scoped to the signed-in person's county.

Authorization is checked on the server for every read and every write, not just hidden in the interface. Each change a person can make is a typed command with its own permission rule, and the server rejects anything the person's role doesn't allow. When the server sends a county's data to a coach or athletic director, it removes other schools' private details first, so they never reach the browser.

ChalkLine's server talks to Postgres directly. Row-level security is enabled on every table, with no policies for the public API roles (anon and authenticated). That means the public keys a browser can see can't read or write any table directly; all access goes through ChalkLine's server and its authorization rules.

Realtime updates are broadcast-only: they tell open screens that something changed, and the screen then asks the server for the data it's allowed to see.

Every change records who made it, when, why, and the before and after. The audit table is append-only, enforced by a database trigger that rejects any update or delete, so no one, including ChalkLine's own application code, can quietly edit history. The one exception is the public demo county, whose fictional data can be reset; real counties' logs can't be purged.

People sign in with Google or Microsoft, the accounts their district already manages, or with a one-time email link. ChalkLine doesn't store passwords. That means the district's own policies (multi-factor authentication, account suspension when someone leaves) apply to ChalkLine automatically when staff use Google or Microsoft.

New people can only join through an invitation from their county: invitations are single use and expire after 14 days, and the county can revoke them.

• In transit: all traffic to ChalkLine and between ChalkLine and its providers uses TLS (HTTPS).
• At rest: the database and its backups are encrypted by our providers (Supabase and Vercel) with provider-managed keys.

Data is stored in a Supabase Postgres database in the United States, and the app is hosted on Vercel. Backups follow Supabase's backup service, which takes daily backups. We'll turn on point-in-time recovery before the first paying county goes live. The full list of providers is in the privacy policy.

ChalkLine limits how often each person can make changes, send invitations, look up invitation codes and use the AI features. That slows down guessing attacks and runaway scripts, and caps AI spending. Invitation-code lookups are limited per network address.

Access follows the county's structure, and each role sees and does only what it needs:

• Athletic council (the chair and members): organizes the county, approves changes that need county sign-off, sets the rules and publishes the season.
• Athletic directors: run their own school's schedule, request changes, and invite and manage their own coaches and office staff.
• Coaches: see their teams' schedules and act only within the permissions their athletic director gives them.
• Board observers: read-only. They can see the county's picture but can't change anything.

Schools see each other only as free or busy when looking for a date. A school's internal events stay private to it.

The AI season builder and Assist use Anthropic's Claude API. The AI proposes; it never writes to the schedule. Its output is a list of suggested changes, each with a reason. A council member chooses which to apply, and ChalkLine's deterministic scheduling engine builds the drafts and checks them for conflicts before anyone publishes. Only the council can use the season builder, and only while the county's account is in good standing.

ChalkLine is a young product, and we'd rather be exact than impressive. We don't claim certifications we don't hold.

If you think you've found a vulnerability in ChalkLine, email security@chalklineathletics.com with the steps to reproduce it. We'll acknowledge your report within 2 business days and keep you updated until it's fixed.

Please test only against your own account or the public demo, don't access or change other people's data, and give us a reasonable time to fix the issue before you disclose it. We won't pursue good-faith research that follows these rules.