Trust Center

Security and privacy overview

This page summarizes the technical and operational controls used to protect Game Is Serious customer data. It is an overview, not a substitute for a signed data processing agreement or security review.

Tenant isolation and access control

Tenant isolation

Production data access is protected by Supabase row-level security. Manager access is constrained to the manager's team, players can access their own records, and service-role access is reserved for server-side operations. Public demos use dedicated server endpoints rather than direct access to tenant data.

Role-based access control

Roles and authenticated route checks separate player, manager, and platform administration capabilities. Access is granted for the task and reviewed as product roles evolve.

Data protection and privacy

Encryption

Supabase provides encryption at rest for stored data. Data is transmitted over TLS between browsers, our application services, and approved sub-processors.

GDPR rights and sub-processors

Data subjects can request access, portability, correction, or erasure. The privacy service supports data export and deletion requests, subject to identity confirmation. See our Privacy Policy for rights, legal bases, and sub-processor information.

Retention

Retention is limited to the purpose and contractual context of the data. Our Privacy Policy describes the applicable retention concepts, including deletion or anonymisation of eligible records.

Operational resilience and secure delivery

Incident response

We investigate suspected security incidents, contain affected systems, preserve relevant evidence, and assess notification obligations. Customer and regulatory notifications are handled according to applicable law and contractual commitments.

Secure software development lifecycle

Release gates include automated tests, secret scanning, contrast checks, scenario validation, and grader evaluations. These controls support reviewable changes and help detect regressions before release.

AI governance and recruiting

AI-assisted features have defined generation boundaries and human accountability. Read our AI Disclosure for product-level transparency. Additional implementation detail is maintained in the AI security and privacy whitepaper at docs/security/ai-security-privacy.md.

Recruiting work samples support human review only. Game Is Serious does not make autonomous hiring decisions and its outputs must not be used as the sole basis for an employment decision.