Security Overview

Movira is built to help sport and recreation teams manage schedules, bookings, forms, and operational documentation—while protecting the confidentiality, integrity, and availability of customer data. This page summarizes the security practices we use to protect the Movira platform.

Security questions: [email protected]

1) Hosting and infrastructure

• Movira is hosted on Amazon Web Services (AWS).

• We design systems with reliability and security in mind, including secure configuration practices and appropriate environment controls.

2) Encryption

• In transit: Data is protected using TLS.

• At rest: Stored data is encrypted at rest.

3) Authentication and access control

• Movira supports:

  • Email/password authentication

  • Google SSO

• Two-factor authentication (2FA) is required for all non SSS accounts.

• Access to data inside Movira is controlled through permissions and roles, allowing organizations to restrict who can view or edit sensitive information (e.g., incident reports, documents, exports).

4) Data segregation and access limitations

• Customer data is logically segregated by account/organization in the application.

• Access to customer data is limited to authorized users within the customer’s organization, based on roles and permissions.

5) Logging and monitoring

• We maintain logs and monitoring designed to help detect issues, support security investigations, and improve reliability.

6) Backups and availability

• We use backups and recovery practices intended to support service continuity and restoration in the event of an outage or data loss incident.

7) Vulnerability management

We take reasonable steps to reduce security risk, including applying security updates, reviewing changes before deployment, and investigating reported issues.

Reporting a vulnerability: Contact [email protected] with details. Please avoid public disclosure until we’ve had a chance to investigate.

8) Incident response

If a security incident occurs, we aim to contain and remediate the issue, investigate scope and impact, notify affected customers where required by law and contract, and take steps to prevent recurrence.

9) Subprocessors and third parties

Movira uses trusted third parties to deliver parts of the service. Key vendors may include:

• AWS (hosting/infrastructure)

• Stripe (payments)

• Google Analytics / PostHog (analytics, where enabled)

• Loops / Mailchimp / Tally (communications/forms, depending on your interaction)

10) Customer responsibilities (shared security)

We recommend customers:

• enforce least-privilege access via roles/permissions,

• remove access promptly when staff leave,

• avoid entering unnecessary sensitive data into free-text fields unless required for operations.