How your data is protected

Layers of security wrap the sensitive core (people's contacts, payment, and tax data). Most protection is native to the stack; the outer trust layer is added as you sell to bigger clients.

5 · Trust & assurance — Vanta · SOC 2 · ISO 27001 · GDPRadd later

4 · Identity & access — MFA · least-privilege · private repoenable

3 · Encryption + governed platform — Palantir · BigQuery · audit logsnative

2 · UPSIDE.irl guardrails — data ring-fence · consent gate · drafts-onlynative

1 · The data (crown jewels)

Assets · Contacts · Payment · Tax

only what each person is allowed to see

■ native = on by default ■ enable = switch on / configure ■ add = future trust milestone

What each layer does

Layer	Protects by…	Provided by
1 · The data	The sensitive core everything else guards	—
2 · UPSIDE.irl guardrails	Ring-fencing contact/payment/tax data, requiring consent before activating anyone, keeping outbound drafts-only	UPSIDE.irl design (D7, D14)
3 · Encryption + platform	Encrypting data in transit & at rest; row/column-level access; full audit logs of who saw/did what	Palantir + BigQuery (native)
4 · Identity & access	MFA, least-privilege roles, private repository — only the right people get in	Google/Palantir/GitHub (enable)
5 · Trust & assurance	Continuous compliance monitoring + a live Trust Center to prove security to buyers	Vanta (add later)

Why add Vanta

Vanta automates security compliance (SOC 2, ISO 27001, GDPR, HIPAA — 35+ frameworks): it plugs into your systems, continuously checks your controls, and gathers audit evidence automatically — plus a real-time Trust Center that shows prospects your security posture. For UPSIDE.irl it means faster deals (clubs/colleges/enterprises pass their security review up front), real credibility handling athlete data, and far less manual audit work for a lean team. Add it around your first paying enterprise pilot — not needed to build or demo.

Design overview, not a security audit or legal advice. Native protections are real today; MFA/policies need enabling; SOC 2 / Vanta is a future milestone — do not claim certifications not yet held. See SECURITY.md.