Encryption
All data in transit is protected with TLS 1.2 or higher. Sensitive fields — including payment references and authentication tokens — are encrypted at rest within our database and storage systems.
Access controls
Staff access follows the principle of least privilege. Provider teams use role-based permissions so coaches, admins and finance users see only what they need. Admin actions are logged for audit purposes.
Backups and recovery
Production databases are backed up continuously with point-in-time recovery. We test restore procedures regularly and maintain disaster recovery plans for critical platform services.
Monitoring
Infrastructure is monitored around the clock for availability, errors and unusual activity. Security alerts are triaged according to severity with defined response procedures.
Audit logs
Key actions — including login events, permission changes, refunds and data exports — are recorded with timestamps and actor identity where applicable. Enterprise customers may request audit log access as part of their agreement.
Infrastructure
Activora runs on modern cloud infrastructure with automatic security patching, network isolation and DDoS protection. Data is stored in reputable EU/UK data centres where available for the service.
Account protection
We support secure password policies, session timeouts and optional two-factor authentication for staff accounts. Parents and providers should use unique, strong passwords and report suspicious activity immediately.
To report a security vulnerability, visit our Security page for responsible disclosure contact details.