Security

Security for a serious training workflow

RaceEval handles training history, recovery notes, and weekly reflections, so account protection and data ownership are part of the product foundation, not an afterthought.

The current beta scope is narrow on purpose: protect signed-in athlete records, keep public pages public, and make sure the comparison and review workflows stay user-owned.

Report an issue

Access control

  • Signed-in app routes are protected behind authentication
  • Public marketing pages stay separate from athlete-specific records
  • Account lifecycle handling is delegated to the auth provider where appropriate

Data isolation

  • Core records are being scoped to the owning user
  • Uploads are linked to athlete-owned workout records
  • Multi-user correctness is treated as a platform-level requirement

Operational posture

  • Beta access expands carefully as observability and support readiness improve
  • Security work is prioritized around real user data, not cosmetic checklists
  • Questions or suspected issues can be reported directly through support