Security and access — WNY Athletics

Everything belongs to an organization

A tournament is owned by an organization — a club, a region, a venue operator. Teams, schedules, officials, contacts, and records all hang off that tournament, so the organization is the boundary: administering one organization gives you nothing in another.

People are added to an organization by email address. When someone signs in, the product matches the verified email addresses on their account against the organization's staff list. An unverified address matches nothing, so adding a person to a staff list does not by itself hand access to whoever controls that mailbox until they have proved it.

Organizations can be nested. An administrator of a parent organization administers the organizations beneath it — which is how a region oversees its clubs, and which is also worth understanding before you attach your club to a parent.

Administrators, and the abilities you can grant instead

A member of an organization is either an administrator of it or not. An administrator can do everything within that organization. Someone who is not an administrator starts with nothing and is granted named abilities one at a time.

Three named abilities exist today, and it is more useful to list them than to describe a system:

Submit live scores — score any match in the organization's tournaments while signed in, without being an administrator. This is the one for a scoring coordinator or a trusted table crew.
Issue a match scoring PIN — create or rotate the PIN for a match, which is how a director hands scoring to a table crew that has no account at all.
Open a draft tournament — see a tournament that has not been published yet.

Everything else is administrator-level. There is no separate finance, communications, or read-only role today — an administrator who can move a match can also record a payment and email your contact list. If that separation matters to your organization, say so; it is a real gap, not an oversight we would rather you did not notice. See entry fees and payment status.

Scoring access, in detail

This is the part most directors ask about, because handing out scoring access at a table on a Saturday is where control usually leaks. Three things can submit a score for a match, and nothing else can:

An administrator of the organization that owns the tournament.
A signed-in person granted the submit-scores ability for that organization.
Anyone holding a valid PIN for that specific match — no account, no sign-in, nothing to install.

The third one is the working answer for a parent volunteer at the scorer's table. A PIN is six characters, drawn from an alphabet with no zero, letter O, one, or letter I in it, so it survives being read aloud across a gym. A director issues one and can rotate it whenever they want.

A PIN opens exactly one match and nothing else. PINs are issued per match rather than per court, so the crew working court three at nine in the morning cannot use the same PIN on the eleven o'clock match on that court.

And the property worth knowing before you hand any of them out: a wrong PIN is refused outright. It does not quietly fall back to whatever account happens to be signed in on that tablet. If a director's own session is open on a shared device and someone types a PIN belonging to a different match, the submission is rejected — it does not go through on the director's authority.

Watching is separate from scoring. Anyone with the link can watch a match live; only submitting is gated. A tournament still in draft is stricter: opening its scoring page at all requires an administrator, the draft-viewing ability, or a valid PIN.

Change history

Changes to schedules, results, teams, divisions, groups, rounds, athletes, team staff, and tournaments are recorded with who made the change, when, and a before-and-after snapshot of the fields that moved. An organization's administrators can search it and see the exact difference — which is what settles a disputed score or a match nobody remembers moving.

The history is administrator-only, and nothing in the product deletes or ages out its entries.

Its limits, stated here rather than discovered later: payment records are not written to it, and neither are changes to who has access. Granting someone administrator rights is not currently recorded in this history.

What is public by design, and what is not

A tournament is meant to be readable by families without an account, so a lot is deliberately public: tournament pages, schedules, pools, brackets, standings, results, the live scoreboard, team pages and the team directory, printable pool sheets and brackets, and the match score sheet.

Administrator-only: the scheduler and everything in it, the organization's administration screens, registration and fee records, the contact directory, the change history, and the director's printed day artifacts — the court day card, the staff day card, and the coach packet. Those three are not links a coach or an official can open.

One thing sits in between and is worth calling out. An official's personal schedule opens from a private link rather than a sign-in — it is convenient precisely because there is nothing to remember. Treat that link like a password: anyone who has it can see that official's assignments and contact details, and it does not expire on its own.

What is visible on a public page, field by field, is on the privacy page.

Getting your data out

An organization's administrators can export their own lists as CSV files — teams, tournaments, venues, schedules and results, officials and staff, and rosters. Imports work the same way round, with a dry run that shows exactly what would change before anything does.

The point is that your tournament data is not held hostage by a format. What is exportable and what is not — and which exports carry personal details — is listed on the privacy page.

What this page does not claim

The most useful thing a security page can do is be specific about its own edges. So, plainly:

We hold no third-party security certification and no audited compliance attestation, and this page names none.
We publish no penetration-test or independent-assessment report.
We state no uptime or availability figure, and nothing in the product measures one.
We make no backup, retention, or disaster-recovery commitment on this page. Nothing in the product performs scheduled backups.
We make no encryption, hosting, or network claim here. Those are properties of how a particular deployment is hosted, and this page cannot vouch for a deployment it does not describe.
We name no payment provider, because none is integrated. Entry fees are recorded, not processed — see entry fees and payment status.

None of that means the answer is "nothing." It means the honest answer depends on your deployment and belongs in writing, to you, rather than in a bullet point aimed at everyone.

If you have a review process

Clubs and regions with a procurement or safeguarding review usually arrive with a questionnaire. Send it. A specific question gets a specific written answer, including where the answer is "we do not do that yet" — which is a better basis for a decision than a page that claims everything.

Reach us through the contact page. If you have found something that looks like a security problem, use the same route and say so in the subject line; do not post it publicly.

Who can do what, and how we know