Skip to content

Security

Eskuadra holds the records an agency lives on: players, some of them minors, contracts, contacts and money. This page says where that data is, how it is kept apart, and who else touches it.

We hold no certifications yet. This page describes what we do; for more detail, ask us under NDA.

Your agency’s data is yours

  • Every table in the database carries an access policy that scopes rows to your agency. A member of one agency cannot read another agency’s rows, in the app, through the assistant or through the API.
  • Inside the agency, roles decide who sees players, private details, pitches and money. Salary and fee figures are visible only to the roles you choose.
  • Admins can ask for a full export of the agency’s data. Deleting a player removes their records.

Where it runs

  • Database, sign-in, files and server functions: Supabase, in the European Union (Frankfurt).
  • The website and the app: Cloudflare, served from its network with EU routing.
  • Sign-in emails: Scaleway, in France.
  • The assistant’s model calls: Anthropic, in the United States, only for the message and the records involved in that answer.

Signing in and keys

  • You sign in with a code or a link sent to your email. There are no passwords for us to store or for anyone to guess.
  • Connected calendar tokens and any agency AI key are stored encrypted; the keys that decrypt them live only in server functions, never in the app.
  • The assistant has no service key. It acts as the signed-in member and can only see and propose what that member could.
  • Deactivating a member removes their access on their next request.

Pages you share with clubs

  • A pitch or a shortlist is a link with a long random token. The page shows only the columns you chose and expires when you say.
  • You see when a link was opened and what caught the club’s eye. We do not store the viewer’s IP address.
  • Your agency’s brand is the only brand on those pages.

Backups and incidents

  • Daily backups by the database provider, with encryption at rest and in transit.
  • The assistant never logs your prompts or answers; per message it records only the model, token counts and timing.
  • If an incident affects your data we tell the agencies concerned promptly: what happened, what it touched, what we did.

Players under 18

Agencies can record players who are minors. Their records follow the same rules as every other player: visible inside the agency by role, outside it only through the columns you choose to share. The law expects more care with their data; so do we.

Agreements and contact

Read the privacy policy and the terms. A data processing agreement is available on request, and we answer security questionnaires.